What’s Vulnerable › Vulnerabilities

CVE-2025-32975: Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-04-20
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-24 · updated 2026-06-17
• Weakness: CWE-287

Description

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.

Affected products

• Quest KACE: from 13.0 before 13.0.385; from 13.1 before 13.1.81; from 13.2 before 13.2.183; from 14.0 before 14.0.341; from 14.1 before 14.1.101 — fixed in 13.0.385, 13.1.81, 13.2.183, 14.0.341, 14.1.101

How to fix

Upgrade to a fixed version: Quest KACE 13.0.385, 13.1.81, 13.2.183, 14.0.341. Check the vendor advisory for mitigations.

References

• https://seclists.org/fulldisclosure/2025/Jun/22
• https://seralys.com/research/CVE-2025-32975.txt
• https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978
• http://seclists.org/fulldisclosure/2025/Jun/25
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32975

Get alerted when CVE-2025-32975 or the next vulnerability affects your stack