The '/common/download_agent_installer.php' script in the Quest KACE System Management…
Priority CRITICAL 100Exploited in the wildCWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.
Summary
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
Why it matters now
Exploitation Active In CISA KEV since 2022-03-25CISA due date 2022-04-15Known ransomware use
EPSS 0.91719 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2022-03-25 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2018-11138
- 2026-10-03 Alias added: GHSA-8m62-73pq-x847
References
More Quest Kace System Management Appliance vulnerabilities
- TI-2018-07907 The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management… CVSS 3.0HIGH 8.8
- TI-2018-07900 In order to perform actions that require higher privileges, the Quest KACE System… CVSS 3.0HIGH 8.8
- TI-2018-07909 The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php'… CVSS 3.0CRITICAL 9.8
- TI-2018-07908 The 'reportID' parameter received by the '/common/run_report.php' script in the Quest… CVSS 3.0CRITICAL 9.8
- TI-2018-07904 The 'orgID' parameter received by the '/common/download_agent_installer.php' script in… CVSS 3.0CRITICAL 9.8
- TI-2018-07902 In order to perform actions that requires higher privileges, the Quest KACE System… CVSS 3.0HIGH 8.8
Sources
- CVE-2018-11138 · CVE Program
- CVE-2018-11138 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-8m62-73pq-x847 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences