Depends on your threat model
VM escape vulnerabilities are, in general, rare compared to other classes of vulnerabilities - there are less such vulnerabilities found each year than e.g. critical vulnerabilities in mainstream operating systems or their bundled components. Assuming that there currently aren't any known unfixed vulnerabilities for VMWare, and that you have the latest VMWare version (which is a reasonable assumption most of the time) this means that you're only vulnerable to attack by an attacker exploiting an as-of-yet unknown zero-day vulnerability. In general, this is expensive - such a zero-day vulnerability can be bought or sold for something in the ballpark of $100 000 so you should expect that this amount of resources would not get "wasted" on a low value target.
So the question is whether it's plausible that someone would spend $100 000 to attack you - most people are low value targets, and in this case there's no "economy of scale" where it would make sense for an attacker to attack lots of random computers (e.g. for ransomware or spam) as most such targets wouldn't have VMs and there's little additional benefit; something like Cryptolocker would bring only marginally more revenue to the attacker if it also included a VM escape exploit.
If you consider that your attackers are likely to spend a substantial amount of resources to target your systems specifically, and your systems can be targeted by a VM escape exploit, then you should consider VM escapes as likely, and not otherwise. It's also worth noting that in order to do a VM escape, the attacker generally needs to gain code execution. So if you are intentionally running attacker-provided code (e.g. as an antivirus company or running code tests for anonymous third parties) then the risk becomes much higher than simply running virtualized servers.
Iccording to SANS criteria, that's not low severity but medium severity - "Vulnerability requires significant resources to exploit, with significant potential for loss".