Critical VGAuth Flaw in VMware Tools Grants Full System Access

Security researchers have uncovered critical vulnerabilities in VMware Tools’ Guest Authentication Service (VGAuth) that allow attackers to escalate privileges from any user account to full SYSTEM access on Windows virtual machines.

The flaws, tracked as CVE-2025-22230 and CVE-2025-22247, affect VMware Tools 12.5.0 and earlier versions across ESXi-managed environments and standalone VMware Workstation deployments.

Authentication Bypass

The primary vulnerability stems from a fundamental flaw in VGAuth’s named pipe authentication mechanism.

The service creates predictable pipe names in the format \\.\pipe\vgauth-service- without using the FILE_FLAG_FIRST_PIPE_INSTANCE flag, enabling attackers to pre-create these pipes with permissive access controls.

By establishing a pipe named vgauth-service-system before the legitimate service, attackers ...