Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability (CVE-2025-32975)

Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.

Published Jun 24, 2025 · Updated May 29, 2026

X LinkedIn

Why patchRisk explained in plain English

Worst-case scenarioIf unpatched

A remote attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2026-05-04 under CISA BOD 22-01.

How the attack worksNo clicks needed

This is a Improper Authentication (CWE-287) vulnerability in Quest KACE Systems Management Appliance (SMA). Exploitation requires remote network access, low attack complexity, no authentication required, and no user interaction required.

📧

Phishing link

→

🖼

Malicious file

🔓

Server compromised

Am I affected?Quick check

Probably yes if any of these apply:

●IT Security

●Running kace systems management appliance: 13.0 ≤ v < 13.0.385, 13.1 ≤ v < 13.1.81, 13.2 ≤ v < 13.2.183, 14.0 ≤ v < 14.0.341, 14.1 ≤ v < 14.1.101

Real-world incidentsWhat we've seen

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2026-04-20 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2026-05-04.

How to patch

Manual remediation steps

Apply the Vendor Patch

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog — apply the vendor's security update as soon as possible.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

Vendor advisory: https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978

NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2025-32975

CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32975

PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2025-32975 ↗ Advisory