Authentication Bypass Vulnerability in Quest KACE Systems Management Appliance
CVE-2025-32975

10CRITICAL

Key Information:

Vendor: Quest
Status: KACE Systems Management Appliance
Vendor: CVE Published:; 24 June 2025

Badges

👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2025-32975?

CVE-2025-32975 is a serious authentication bypass vulnerability found in the Quest KACE Systems Management Appliance (SMA) across multiple versions. This product is designed to aid organizations in managing their IT systems and devices efficiently. However, the vulnerability arises from the Single Sign-On (SSO) authentication handling mechanism, allowing attackers to impersonate legitimate users without possessing valid credentials. This type of flaw could lead to a complete administrative takeover of the appliance, which could have dire implications for an organization’s IT infrastructure and data security.

The CVE affects various versions of the KACE SMA, notably those prior to specific patch releases in versions 13.0.x, 13.1.x, 13.2.x, 14.0.x, and 14.1.x. If exploited, this vulnerability could enable malicious actors to bypass security measures and gain unauthorized access to critical system functions that are typically restricted to legitimate users.

Potential impact of CVE-2025-32975

Unauthorized Access and Control: Attackers could gain administrative rights, allowing them to access sensitive information, alter configurations, or perform unauthorized actions on managed systems.
Data Breaches: The ability to impersonate legitimate users could result in unauthorized data access or exfiltration, leading to potential breaches of sensitive organizational data and compliance violations.
Operational Disruption: With administrative control, an attacker could disrupt regular operations, execute harmful activities, or even deploy malware within the organization's network, leading to significant downtime and recovery costs.

CISA has reported CVE-2025-32975

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2025-32975 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.