Read the docs
TI-2025-23985 Aliases CVE-2025-32975GHSA-hrwx-88rh-95q7

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before…

Priority CRITICAL 100Exploited in the wildCWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.

Summary

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.

Why it matters now

Exploitation Active In CISA KEV since 2026-04-20CISA due date 2026-05-04
EPSS 0.02487 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:quest:kace_systems_management_appliance:*:*:*:*:*:*:*:*13.0 to before 13.0.385; 13.1 to before 13.1.81; 13.2 to before 13.2.183; 14.0 to before 14.0.341; 14.1 to before 14.1.101VulnerableQuest
  • cpe:2.3:a:quest:kace_systems_management_appliance:*:*:*:*:*:*:*:* Versions 13.0 to before 13.0.385; 13.1 to before 13.1.81; 13.2 to before 13.2.183; 14.0 to before 14.0.341; 14.1 to before 14.1.101 Vulnerable ·Quest

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-04-20 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-32975
  3. 2026-10-03 Alias added: GHSA-hrwx-88rh-95q7

References

Advisory 4

  • TI-2021-12037 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. CVSS 3.1CRITICAL 9.8
  • TI-2021-12041 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. CVSS 3.1CRITICAL 9.8
  • TI-2021-12039 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. CVSS 3.1CRITICAL 9.8
  • TI-2022-12168 A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA)… CVSS 3.1CRITICAL 9.8
  • TI-2017-09298 SQL injection exists in Quest KACE Asset Management Appliance 6.4.120822 through 7.2… CVSS 3.0CRITICAL 9.8
  • TI-2019-09668 Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to… CVSS 3.1CRITICAL 9.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences