critical10.0Known exploited
CVE-2025-32975
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-04-20. Federal due date: 2026-05-04.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Quest | Kace Systems Management Appliance | from 13.0 before 13.0.385 from 13.1 before 13.1.81 from 13.2 before 13.2.183 from 14.0 before 14.0.341 from 14.1 before 14.1.101 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://seclists.org/fulldisclosure/2025/Jun/22
- https://seralys.com/research/CVE-2025-32975.txt
- https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978
- http://seclists.org/fulldisclosure/2025/Jun/25
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32975