Incorrect authorization in Quest KACE Systems Management Appliance
Priority MEDIUM 41CWE-863Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00182 7th percentileScored 2026-11-07
Fix Fixed KACE Systems Management Appliance (Quest): 14.0.97, 14.1.19
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Quest | KACE Systems Management Appliance | before 14.0.97; 14.1.0 to before 14.1.19 | 14.0.97, 14.1.19 | Patch available | CNA |
- KACE Systems Management Appliance VendorQuest Affected before 14.0.97; 14.1.0 to before 14.1.19 Fixed in 14.0.97, 14.1.19 Patch available CNA
Remediation
- Fix · CNA KACE Systems Management Appliance (Quest) Fixed in 14.0.97, 14.1.19
Timeline
- 2026-10-02 Threatist record created from CVE-2025-26850
- 2026-10-03 Alias added: GHSA-xp38-x25m-8fpq
References
More Quest vulnerabilities
- TI-2025-23985 Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before… KEVCVSS 3.1CRITICAL 10.0
- TI-2018-07906 The '/common/download_agent_installer.php' script in the Quest KACE System Management… KEVCVSS 3.1CRITICAL 9.8
- TI-2012-04921 The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust… CVSS 2.0HIGH 10.0
- TI-2018-01077 Stack-based buffer overflow in Quest NetVault Backup CVSS 3.0CRITICAL 9.8
- TI-2017-12724 SQL injection in Quest NetVault Backup CVSS 3.0CRITICAL 9.8
- TI-2017-04330 Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2025-26850 · CVE Program
- CVE-2025-26850 · NVD
- FIRST EPSS
- GHSA-xp38-x25m-8fpq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences