VMware’s security advisory has shared no workarounds or mitigation advice, so the only safe option is to move to the recommended versions. Administrators are recommended to upgrade to versions 8.9.4, 8.8.6, and 8.7.8 or later. VMware strongly recommends administrators to 'upgrade as soon as possible' to a safe version of the product.ĬVE-2023-20858 impacts VMware Carbon Black App Control for Windows version 8.7.7 and older, version 8.8.5 and older, and version 8.9.3 and older. They can lead to complete compromise of backend systems and all clients that connect to the vulnerable application. Injection flaws allow attackers to execute commands or code in the target app. “A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system,” reads VMware’s advisory. Tracked as CVE-2023-20858, the issue was discovered by security analyst Jari Jääskelä and could allow a threat actor with privileged access to the App Control administration console to get access to the operating system using specially crafted input. The company warns that the severity rating of the security issue is 9.1 out of 10 and that an attacker can leverage it to gain access to the underlying operating system.Ĭarbon Black App Control is a suite designed to help large organizations ensure that its critical endpoints run only trusted and approved software. VMware has released a critical security upgrade to address a critical injection vulnerability that impacts several versions of Carbon Black App Control for Windows.

The best antivirus 2015