API Access Vulnerability in Quest KACE Systems Deployment Appliance
CVE-2021-32084

9.8CRITICAL

Key Information:

Vendor: Quest Software
Status: KACE Systems Deployment Appliance
Vendor: CVE Published:; 27 July 2026

🔔 Create Quest Software Vulnerability Alert

What is CVE-2021-32084?

A vulnerability exists in Quest KACE Systems Deployment Appliance (SMA) version 11.0.273, where access restrictions applied to the web console by IP address or subnets do not extend to API endpoints. If an attacker gains access to valid credentials or API keys, they can exploit this oversight to infiltrate the system via the API. This situation could enable unauthorized users to access sensitive configurations and data, thereby compromising the entire deployment environment.

References

https://support.quest.com/download-product-select

https://support.quest.com/kace-systems-management-applian...

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 27, 2026
Vulnerability Reserved
May 6, 2021

CVE-2021-32084 Data

JSON