Authentication Bypass Vulnerability in Quest KACE Systems Management Appliance
CVE-2025-32975

10CRITICAL

Key Information:

Vendor

Quest

Status
KACE Systems Management Appliance
Vendor
CVE Published:
24 June 2025

What is CVE-2025-32975?

The Quest KACE Systems Management Appliance is susceptible to an authentication bypass vulnerability that enables attackers to mimic legitimate users. This severe flaw, located within the single sign-on (SSO) authentication processing, can allow malicious actors to gain unauthorized access and potentially execute a complete administrative takeover of the system. Organizations using affected versions are urged to apply the latest patches to mitigate the risks associated with this vulnerability.

References

https://support.quest.com/kb/4379499/quest-response-to-ka...
https://seclists.org/fulldisclosure/2025/Jun/22
https://seralys.com/research/CVE-2025-32975.txt

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-32975 : Authentication Bypass Vulnerability in Quest KACE Systems Management Appliance