---
id: 5090
title: "The Guest Who Could: Exploiting LPE in VMWare Tools"
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/the-guest-who-could-exploiting-lpe-in-vmware-tools/"
published_at: "2025-07-22T13:32:24Z"
tags: ["vulnerability-research", "windows", "saml", "vmware-tools", "vgauth", "local-privilege-escalation"]
phying_url: "https://phying.com/item/5090"
lang: en
---

# The Guest Who Could: Exploiting LPE in VMWare Tools

## Summary

PT SWARM details LPE flaws in VMware Tools' Windows VGAuth service (12.5.0) — a SYSTEM-level component for alias store, ticket and SAML auth on guest VMs, an overlooked guest-only attack surface.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **Published:** 2025-07-22T13:32:24Z
- **Original:** https://swarm.ptsecurity.com/the-guest-who-could-exploiting-lpe-in-vmware-tools/
- **Phying News:** https://phying.com/item/5090