# CVE-2020-3950: VMware Multiple Products Privilege Escalation Vulnerability

> CVE-2020-3950: VMware Multiple Products Privilege Escalation Vulnerability. CVSS 7.8 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2020-3950
Last updated: 2025-10-21T23:35:48Z

- Published: 2020-03-17 18:41 UTC · Updated: 2025-10-21 23:35 UTC · Assigner: vmware
- CVSS: 7.8 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS: 7.3%, 94th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2021-11-03, federal due date 2022-05-03, ransomware use: Unknown

## Description

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.

## CISA required action

Apply updates per vendor instructions.

## Affected vendors and products

- n/a: VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2020-3950)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2020-3950)
- [http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html](http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html)
- [http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html](http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html)
- [https://www.vmware.com/security/advisories/VMSA-2020-0005.html](https://www.vmware.com/security/advisories/VMSA-2020-0005.html)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2020-3950 · Markdown: https://rewindex.com/cve/CVE-2020-3950.md · JSON: https://rewindex.com/api/v1/cves/CVE-2020-3950 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:13:46.656Z