Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jun 24, 2025 · Catalog

   Detected

   Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead

2. Apr 20, 2026 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. May 4, 2026 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Jun 17, 2026 · Catalog

   Updated

   Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead

Affected

• cpe quest/kace systems management applianceversion unspecified
• vendor Quest KACE Systems Management Appliance (SMA)version unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2025-32975

  Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.

  cisa.gov
• CVE.orgVulnerability recordCVE-2025-32975

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-32975

  30-day exploitation probability 2.5%

  first.org
• NIST NVDVulnerability recordCVE-2025-32975

  Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitim

  nvd.nist.gov

References

• Mailing List · seclists.org
• CISA note · nvd.nist.gov
• Mailing List · seclists.org
• Third Party Advisory · seralys.com
• CISA note · support.quest.com
• US Government Resource · cisa.gov