CVE-2025-32975

VendorquestProductkace systems management applianceDiscoveredJun 24, 2025UpdatedApr 21, 2026

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.

View graph Watch Export

CVSS v3.1

10 CRITICAL

EPSS

2.49%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Sep 26, 2026

▲ 0.07pp

2.42% → 2.49% over 4 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Connections

4 relationships

CWE-287

source

Timeline

disclosure → media coverage

Jun 24, 2025

Disclosure — published as a CVE record. · last revised by NVD Apr 21, 2026

Mar 21, 2026

securityweek.com reports: Critical Quest KACE Vulnerability Potentially Exploited in Attacks

Mar 23, 2026

thehackernews.com reports: Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems