The Guest Who Could: Exploiting LPE in VMWare Tools
swarm.ptsecurity.com | research | #vulnerability-research | #windows | #saml | #vmware-tools | #vgauth | #local-privilege-escalation
Summary
PT SWARM details LPE flaws in VMware Tools' Windows VGAuth service (12.5.0) — a SYSTEM-level component for alias store, ticket and SAML auth on guest VMs, an overlooked guest-only attack surface.
- Published
- Collected
--- id: 5090 title: "The Guest Who Could: Exploiting LPE in VMWare Tools" source_domain: swarm.ptsecurity.com source_url: "https://swarm.ptsecurity.com/the-guest-who-could-exploiting-lpe-in-vmware-tools/" published_at: "2025-07-22T13:32:24Z" tags: ["vulnerability-research", "windows", "saml", "vmware-tools", "vgauth", "local-privilege-escalation"] phying_url: "https://phying.com/item/5090" lang: en --- # The Guest Who Could: Exploiting LPE in VMWare Tools ## Summary PT SWARM details LPE flaws in VMware Tools' Windows VGAuth service (12.5.0) — a SYSTEM-level component for alias store, ticket and SAML auth on guest VMs, an overlooked guest-only attack surface. ## Intelligence Metadata - **Sources:** swarm.ptsecurity.com - **Published:** 2025-07-22T13:32:24Z - **Original:** https://swarm.ptsecurity.com/the-guest-who-could-exploiting-lpe-in-vmware-tools/ - **Phying News:** https://phying.com/item/5090