VMware Tools CVE-2025-22230 and CVE-2025-22247: Impact, Fixes and How to Patch

Key takeaways

• These are local privilege escalation issues inside a guest VM. An attacker needs a foothold first, such as a low-privileged account.
• CVE-2025-22230 is reported as an authentication bypass in VMware Tools for Windows (CVSS 7.8), fixed in 12.5.1. CVE-2025-22247 is reported as an insecure file handling issue (CVSS 6.1), fixed in 12.5.2.
• The practical fix is simple: upgrade VMware Tools to the latest 12.5.x release and verify the version on every guest.
• Treat these as one part of layered defence: limit who can log in to guests, monitor privilege changes, and keep hypervisor tooling patched.
• Verify details in the Broadcom security advisories and the National Vulnerability Database. This page explains the class of flaw without exploit steps.

What are CVE-2025-22230 and CVE-2025-22247?

Both are 2025 vulnerabilities in VMware Tools, the guest software that integrates a virtual machine with the VMware hypervisor. They sit in the VGAuth component, the VMware Guest Authentication Service, which lets the host and management tools authenticate operations inside a guest. According to public reporting based on the Broadcom advisories:

Check the exact wording, scores and affected versions in the National Vulnerability Database and the Broadcom security advisories. Research credit for the findings has been reported to PT SWARM and an independent researcher. Earlier versions of this page gave a single disclosure date. The advisories were published at different times in 2025, so use the dates in the Broadcom notices.

What does "local privilege escalation" mean here?

Local privilege escalation (LPE) means an attacker who already has limited access on a machine uses a flaw to gain more power, in this case higher privileges inside a guest. It does not give remote access to the machine. The attacker first needs a way in, such as a compromised low-privilege user account, a malicious insider or another vulnerability. The risk is what happens next: with higher privileges an attacker can disable security tools, read secrets, install persistence and move across the network.

How do these flaws arise? A conceptual view

For defenders and students, the useful lesson is the class of mistake, not a recipe.

• Trusting a name that another user can claim (named pipe confusion). If a privileged service communicates over a channel whose name is predictable and that a low-privileged user can create first, the service may talk to the wrong party. Secure software creates such channels with exclusive ownership and verifies the peer.
• Insecure file operations. If a privileged component reads or deletes files in locations a low-privileged user can influence, it may be tricked into acting on the wrong file. Safe designs validate paths, avoid following links and use directories with restricted permissions.

The weakness types are catalogued by MITRE. Studying them helps in code review and in writing detections. This article does not give working exploit steps.

Who is affected?

Organisations running virtual machines with VMware Tools below the fixed versions, on supported VMware products (for example ESXi and Workstation environments) and on guest operating systems named in the advisories. Because VMware Tools is installed in each guest, patching needs to cover guests, not only the hypervisor. Check the advisory for which platforms and versions apply to your estate.

How do you find out whether you are exposed?

1. Inventory. List all guests with their VMware Tools versions. In vCenter, the VM list can show tools version status. On a guest, check the installed version from the VMware Tools information or program listing.
2. Compare with the advisory. Anything older than the fixed version, and on a platform listed as affected, is exposed.
3. Check support status. Make sure your VMware or Broadcom entitlement lets you download the update.

How do you patch?

1. Download the current VMware Tools 12.5.x release through the official Broadcom channel, and read the release notes for 12.5.1 and 12.5.2.
2. Test on a non-production guest.
3. Roll out by tools upgrade policy, your configuration management or software distribution tool, or vSphere's automated upgrade, with maintenance windows where a reboot is needed.
4. Verify the version on each guest afterwards and record the result.
5. Keep VMware Tools on a regular patch cycle.

What can you do if you cannot patch immediately?

• Restrict who can log in to guests and remove unused local accounts.
• Apply least privilege and application control on Windows guests.
• Monitor for new administrators, service installs and unexpected processes running as SYSTEM.
• Prioritise guests that host shared access, for example jump hosts and virtual desktops.

How can you detect abuse?

Look for unusual process creation by VMware Tools services, new local administrators (event ID 4732), new services (7045), and low-privileged accounts that suddenly run elevated processes. EDR rules for privilege escalation help. Map your coverage to the privilege escalation tactics in MITRE ATT&CK.

What is the bigger lesson?

Management agents and guest tools run with high privilege on every machine, so they are attractive targets. Keep an inventory of such agents, patch them on the same discipline as the operating system, and track advisories. For India-based organisations, CERT-In also publishes vulnerability notes.

Next steps

To learn how to find and fix flaws like these, see WebAsha's VAPT training. Related reading: new security flaws in VMware Tools and CrushFTP.