Privilege Escalation in VMware Fusion, VMRC & Horizon Client for Mac (CVE‑2020‑3950)
What It Is – VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a set‑uid binary misuse that lets a local attacker elevate their rights to the root account.
Exploitability – The vulnerability is publicly disclosed; proof‑of‑concept code exists, and a patch was released in March 2021. CVSS v3.1 base score 7.8 (High).
Affected Products – VMware Fusion 12.x, VMware Remote Console for Mac 12.x, and Horizon Client for Mac 20.x (all Windows‑compatible Mac agents).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – The flaw bypasses the principle of least privilege, a core control objective for any organization that must demonstrate robust identity and access management.
- Audit‑ready evidence – Remediating the issue and documenting patch status provides concrete evidence for auditors evaluating access‑control controls across frameworks (e.g., NIST CSF 2.0, ISO 27001).
- Continuous monitoring – Detecting lingering set‑uid binaries after patching supports a defensible, real‑time control‑monitoring posture that enterprise buyers increasingly demand.
Recommended Actions
- Apply VMware’s security patch (KB 2021‑001) to all affected macOS hosts immediately.
- Verify that the set‑uid binaries (
/Applications/VMware Fusion.app/Contents/Library/VMware‑VMX) have been removed or correctly permissioned post‑patch. - Update your asset inventory and configuration‑management database (CMDB) to reflect the patched state.
- Enable endpoint telemetry to alert on any re‑creation of privileged binaries.
- Capture patch‑deployment logs as audit evidence for control‑assurance reviews.
Source: CISA KEV – CVE‑2020‑3950