The Google Cloud-owned incident response firm said the flaw is being used by a Chinese advanced persistent threat group that Mandiant refers to as "UNC3886." VMware said in its security advisory that the flaw, tracked as CVE-2023-20867, is an authentication bypass that can be exploited when a "fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine."