CVE-2018-11138: Quest KACE System Management Appliance unauthenticated OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a CVSS score of 9.8, active exploitation in CISA KEV, and documented ransomware use make this an urgent patch-first issue.

What it is

The download_agent_installer.php script in Quest KACE System Management Appliance 8.0.318 is reachable by anonymous users and passes input to the operating system without proper sanitization, allowing arbitrary command execution. Because no authentication is required, any network-reachable attacker can run commands as the web service account on the appliance.

Impact

An attacker gains remote code execution on the KACE appliance, enabling full compromise of the system and any credentials or managed endpoints it controls. CISA lists this vulnerability as used in known ransomware campaigns, so impact can extend to enterprise-wide encryption and lateral movement.

Attack surface

Reached over the network via HTTP(S) requests to /common/download_agent_installer.php; the CVSS vector shows PR:N and UI:N, meaning no authentication and no user interaction are required.

Exploitation

CISA KEV lists it as actively exploited with known ransomware campaign use, and EPSS is 0.92061 (99.8th percentile); public exploit code is referenced in Exploit-DB and Core Security advisories.

What to do

• Apply the vendor update for KACE System Management Appliance per Quest instructions; this is the only complete fix.
• If patching cannot be done immediately, restrict network access to the appliance management interface to trusted administrative networks only.
• Block or monitor external access to /common/download_agent_installer.php at the perimeter until the patch is applied.
• Rotate credentials and secrets stored on or managed by the appliance after any suspected exposure.
• Review appliance logs for unauthorized command execution or unexpected outbound connections.

Detection

• Monitor web server and appliance logs for requests to /common/download_agent_installer.php, especially with unusual parameters or command metacharacters.
• Alert on unexpected child processes spawned by the web service account (for example shell, curl, wget, or netcat).
• Hunt for outbound connections from the KACE appliance to unfamiliar hosts or command-and-control infrastructure.
• Correlate appliance access with authentication logs to identify anonymous access to administrative scripts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.