CVE-2022-22943 json
VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability.
published 2022-03-03 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-28068
- cvss
- 6.7
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 0
- none known
Summary
VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with local administrative privileges in the Windows guest OS, where VMware Tools is installed, may be able to execute code with system privileges in the Windows guest OS due to an uncontrolled search path element.
Patch / fix
- vmware tools 12.0.0
Exploit prediction
1.22% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- n/a VMware Tools for Windows
Classification
- Weakness
-
- CWE-427 Uncontrolled Search Path Element
- Technology feeds
References
-
vmware.com
/security/advisories/VMSA-2022-0007.html
vendor-advisory
Sources
- CVE List CVE-2022-22943
- NVD CVE-2022-22943
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.