TI-2020-03448 Aliases CVE-2020-3950 GHSA-fx3w-hj7j-hfgf

Improper privilege management in VMware Fusion, VMware Remote Console for Mac and Horizon…

CRITICAL 93Exploited in the wildCWE-269Published 2020-03-17 · Updated 2025-10-21

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-269.

Summary

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03

EPSS 0.07254 94th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac	VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0)	—	No fix listed	CNA

VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac Vendor— Affected VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:fusion::::::::	11.0.0 to before 11.5.2	Vulnerable	VMware
cpe:2.3:a:vmware:horizon_client::::::::	5.0.0 to before 5.4.0	Vulnerable	VMware
cpe:2.3:a:vmware:remote_console::::::::	11.0.0 to before 11.0.1	Vulnerable	VMware
cpe:2.3:o:apple:macos:-:::::::*	not specified by NVD	Running on	Apple

cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* Versions 11.0.0 to before 11.5.2 Vulnerable ·VMware
cpe:2.3:a:vmware:horizon_client:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.4.0 Vulnerable ·VMware
cpe:2.3:a:vmware:remote_console:*:*:*:*:*:*:*:* Versions 11.0.0 to before 11.0.1 Vulnerable ·VMware
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple

Remediation

No fixed version listed by the sources yet.

Timeline

2021-11-03 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2020-3950
2026-10-03 Alias added: GHSA-fx3w-hj7j-hfgf

References

Exploit 2

Advisory 1

https://www.vmware.com/security/advisories/VMSA-2020-0005.html

TI-2025-16137 Out-of-bounds read in ESXi KEVCVSS 3.1HIGH 7.1
TI-2017-03716 Observable discrepancy in Intel Most Modern Operating Systems CVSS 3.1MEDIUM 5.6
TI-2017-03034 Memory corruption in VMware Workstation Pro/Player CVSS 3.0CRITICAL 9.9
TI-2016-04622 Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware… CVSS 3.1HIGH 7.8
TI-2011-03420 Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5… CVSS 2.0HIGH 9.3
TI-2024-14840 Use-after-free in VMware ESXi CVSS 3.1CRITICAL 9.3

See all 130 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences