For VMware virtual machines, you can use a method similar to what is currently proposed in the VMware official instructions, but without the need for external disks or manual UEFI UI interaction. The approach involves adding the Microsoft provided Windows OEM Devices PK certificate directly to the UEFI from within the guest OS, which unblocks the automatic certificate update process and allows it to complete successfully.

The steps in brief are:

1. Shut down the virtual machine
2. Add the advanced parameter uefi.secureBootMode.overrideOnce with value SetupMode to the VM configuration in vSphere
3. Power on the virtual machine (note: must be a full power-on, not a restart)
4. Verify that UEFI SetupMode is active by running (Get-SecureBootUEFI SetupMode).Bytes[0] — expected result is 1
5. Verify the current PK status using Get-SecureBootUEFI -Name PK to confirm remediation is needed
6. Enroll the Windows OEM Devices PK certificate using Format-SecureBootUEFI piped to Set-SecureBootUEFI
7. Set the AvailableUpdates registry key to 0x5944 under HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot
8. Restart the machine. Secure Boot will re-enable automatically as SetupMode clears after the PK is enrolled
9. Allow the Secure-Boot-Update scheduled task to run, then restart at least once more and verify UEFICA2023Status = Updated

The detailed commands for steps 4 through 6 are described in Step 12 of a community published article on GitHub. A Google search for "Secure Boot 2023 Certificate Remediation - Manual Procedure (No Scripts)" should lead you directly to it.

Importantly, you only need to follow Step 12 from that guide and nothing else. The preceding steps in the guide handle NVRAM regeneration and manual KEK enrollment, which are not necessary here. Once the PK is corrected, the Windows automated update process takes care of the KEK, DB and boot manager updates by itself.