Read the docs
TI-2022-07121 Aliases CVE-2022-22943GHSA-v28q-xfvc-8p57

Uncontrolled search path in VMware Tools for Windows

Priority LOW 32CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with local administrative privileges in the Windows guest OS, where VMware Tools is installed, may be able to execute code with system privileges in the Windows guest OS due to an uncontrolled search path element.

Why it matters now

EPSS 0.01216 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware Tools for WindowsVMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0)—No fix listedCNA
  • VMware Tools for Windows Vendor— Affected VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:tools:*:*:*:*:windows:*:*:*10.0.0 to before 12.0.0VulnerableVMware
  • cpe:2.3:a:vmware:tools:*:*:*:*:windows:*:*:* Versions 10.0.0 to before 12.0.0 Vulnerable ·VMware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22943
  2. 2026-10-03 Alias added: GHSA-v28q-xfvc-8p57

References

Advisory 1

  • TI-2025-27491 VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple… KEVCVSS 3.1HIGH 7.8
  • TI-2023-07286 VMware Tools Authentication Bypass Vulnerability KEVCVSS 3.1LOW 3.9
  • TI-2016-04622 Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware… CVSS 3.1HIGH 7.8
  • TI-2023-07316 Authentication bypass by capture-replay in VMware Tools CVSS 3.1HIGH 7.5
  • TI-2021-05043 Uncontrolled search path in VMware Tools for Windows, VMware Remote Console for Windows… CVSS 3.1HIGH 7.8
  • TI-2023-16924 Improper signature verification in VMware Tools CVSS 3.1HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences