CVE-2025-32975

What it actually does

This is a network-exploitable authentication bypass in Quest KACE Systems Management Appliance SSO authentication handling. An unauthenticated attacker can impersonate legitimate users, including administrative users, without valid credentials. Because KACE SMA is used for endpoint inventory, software deployment, patching, scripting, and remote systems management, successful exploitation can give an attacker administrative control over the appliance and the ability to interact with managed endpoints through trusted management functions. The CVSS 10.0 rating reflects no authentication requirement, low attack complexity, no user interaction, scope change, and full confidentiality, integrity, and availability impact.

Why it matters to the business

Compromise of a KACE SMA appliance can become a central management compromise: attackers may gain access to device inventory, software packages, scripts, credentials or tokens stored in the platform, patching workflows, and deployment capabilities. This can enable broad operational disruption, unauthorized software distribution, endpoint compromise, data exposure, and loss of trust in endpoint management. The vulnerability is listed in CISA KEV, has observed in-the-wild exploitation, and has a federal remediation due date of 2026-05-04, so affected internet-facing or broadly reachable appliances should be treated as high-priority exposure even though the EPSS score is currently modest.

How an attack unfolds

An attacker first identifies a reachable Quest KACE SMA appliance and determines whether it is running an affected 13.0.x, 13.1.x, 13.2.x, 14.0.x, or 14.1.x release. The attacker then sends crafted SSO authentication traffic that abuses improper authentication handling to create or assume an authenticated session without knowing a valid password. If the attacker impersonates an administrator or can elevate to administrative capability through the appliance, they can take over the SMA console. From there, they may enumerate managed assets, alter appliance configuration, create users, deploy scripts or software, access stored management data, and use the appliance as a trusted pivot into managed endpoints. Public reporting and CISA KEV status indicate active exploitation in the wild; defenders should assume exposed unpatched appliances may already have been targeted.

How to fix it

Upgrade Quest KACE Systems Management Appliance to a fixed release immediately. Fixed versions are: 13.0.385 or later for 13.0.x, 13.1.81 or later for 13.1.x, 13.2.183 or later for 13.2.x, 14.0.341 Patch 5 or later for 14.0.x, and 14.1.101 Patch 4 or later for 14.1.x. If immediate upgrade is not possible, restrict access to the SMA administrative and SSO interfaces to trusted management networks or VPNs, block direct internet exposure, enforce network-layer allowlisting, review and harden SSO configuration, and increase logging until the appliance is patched. Because the flaw permits impersonation, password changes alone are not sufficient remediation, but administrative passwords, API tokens, SSO secrets, and integration credentials should be rotated after patching if compromise is suspected.

How to confirm the fix worked

Confirm the appliance version and patch level from the SMA administrative interface or vendor-supported command/status mechanisms and verify it is at or above the fixed version for its release branch. Independently scan externally and internally reachable management interfaces to ensure no affected KACE SMA versions remain exposed. Validate that administrative and SSO endpoints are not reachable from untrusted networks unless explicitly required. After patching, test normal SSO and local authentication flows to confirm expected behavior, review release notes to verify the security patch was applied, and run a focused audit for unexpected administrative users, SSO configuration changes, deployment packages, scripts, scheduled tasks, and recent administrative sessions created before remediation.

Typical attack path

1. Discover a reachable Quest KACE Systems Management Appliance instance.
2. Fingerprint the appliance version or infer exposure from response behavior and interface metadata.
3. Send crafted SSO authentication requests that bypass normal credential validation.
4. Establish an authenticated session as a legitimate user, potentially an administrator.
5. Use administrative SMA functions to enumerate assets, users, packages, scripts, patching jobs, and appliance configuration.
6. Create persistence such as new administrative accounts, modified SSO settings, scheduled tasks, scripts, or deployment packages.
7. Use the appliance’s endpoint management capabilities to push commands, scripts, or software to managed systems or to collect sensitive operational data.
8. Cover tracks by deleting or altering audit records where permissions allow.

How to detect it

Investigate SMA appliance access, authentication, SSO, administrative audit, web server, and deployment logs for activity before patching and during the exposure window. Look for successful SSO-authenticated sessions without matching identity-provider events, administrative logins from unusual IP addresses or geographies, session creation without prior credential validation, sudden changes to SSO configuration, new or modified administrator accounts, unexpected API token creation, unusual package uploads, new scripts, mass deployment jobs, or remote command execution activity. Correlate SMA login times with identity provider logs; any SMA SSO session lacking a corresponding IdP assertion, MFA event, or successful authentication record should be treated as suspicious. Review appliance backups, configuration history, and audit exports for unauthorized changes. On managed endpoints, hunt for commands, scripts, installers, or processes launched by the KACE agent around the time of suspicious appliance activity. Because no universal public exploit artifact is provided, detection should emphasize behavioral anomalies and mismatches between SMA-side sessions and authoritative identity-provider records.

What your security team should do

• Treat this as a critical, actively exploited management-plane vulnerability and prioritize patching of all affected KACE SMA appliances ahead of routine maintenance windows.
• Immediately remove direct internet exposure for SMA administrative and SSO interfaces where possible; restrict access to trusted administrator networks or VPNs.
• Upgrade to the appropriate fixed version: 13.0.385+, 13.1.81+, 13.2.183+, 14.0.341 Patch 5+, or 14.1.101 Patch 4+.
• Perform a compromise assessment before and after patching, focusing on anomalous SSO logins, new privileged users, unexpected configuration changes, and suspicious deployment activity.
• Review all administrative accounts, API keys, SSO trust relationships, appliance integrations, packages, scripts, patch jobs, and scheduled tasks for unauthorized changes.
• Rotate administrative credentials, API tokens, integration credentials, and SSO secrets if there is any indication the appliance was exposed while vulnerable or accessed suspiciously.
• Increase monitoring for KACE SMA authentication, administrative, and software deployment events for at least several weeks after remediation.
• Use CISA KEV status and the 2026-05-04 due date as a minimum compliance driver, not as a reason to delay remediation.