Read the docs
TI-2019-03920 Aliases CVE-2019-5514GHSA-6vc3-crc6-4w78

Missing authentication in VMware Fusion

Priority MEDIUM 44CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

VMware VMware Fusion (11.x before 11.0.3) contains a security vulnerability due to certain unauthenticated APIs accessible through a web socket. An attacker may exploit this issue by tricking the host user to execute a JavaScript to perform unauthorized functions on the guest machine where VMware Tools is installed. This may further be exploited to execute commands on the guest machines.

Why it matters now

EPSS 0.03484 89th percentileScored 2026-11-07
Fix Fixed VMware Fusion (VMware): 11.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareVMware Fusion11 to before 11.0.311.0.3Patch availableCNA
  • VMware Fusion VendorVMware Affected 11 to before 11.0.3 Fixed in 11.0.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*11.0.0 to before 11.0.3VulnerableVMware
  • cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* Versions 11.0.0 to before 11.0.3 Vulnerable ·VMware

Remediation

  • Fix · CNA VMware Fusion (VMware) Fixed in 11.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5514
  2. 2026-10-03 Alias added: GHSA-6vc3-crc6-4w78

References

Advisory 2

  • TI-2020-03448 Improper privilege management in VMware Fusion, VMware Remote Console for Mac and Horizon… KEVCVSS 3.1HIGH 7.8
  • TI-2025-16137 Out-of-bounds read in ESXi KEVCVSS 3.1HIGH 7.1
  • TI-2017-03716 Observable discrepancy in Intel Most Modern Operating Systems CVSS 3.1MEDIUM 5.6
  • TI-2017-03034 Memory corruption in VMware Workstation Pro/Player CVSS 3.0CRITICAL 9.9
  • TI-2016-04622 Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware… CVSS 3.1HIGH 7.8
  • TI-2011-03420 Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5… CVSS 2.0HIGH 9.3
See all 130 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences