CVE-2025-32975: Quest KACE SMA SSO authentication bypass allows admin takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 10.0 unauthenticated network authentication bypass leading to full administrative takeover, with confirmed exploitation per CISA KEV.

What it is

Quest KACE Systems Management Appliance contains an authentication bypass in its SSO authentication handling, letting attackers impersonate legitimate users without valid credentials. Because the appliance is used for endpoint management and patching, a bypass leading to full administrative takeover puts every managed device at risk.

Impact

An unauthenticated attacker can impersonate users and achieve complete administrative control of the KACE SMA, enabling management-agent abuse, script or patch deployment, and access to managed endpoints and their data.

Attack surface

Reachable over the network via the SSO authentication handling mechanism, per the CVSS vector AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is required. The description does not specify which SSO endpoint or protocol is involved.

Exploitation

CVE-2025-32975 is listed in CISA KEV with a 2026-05-04 remediation due date, indicating known exploitation; EPSS 30-day probability is about 2.5 percent (83rd percentile). No ransomware campaign use is documented.

What to do

• Upgrade to the fixed KACE SMA releases: 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5) or 14.1.101 (Patch 4), or later.
• If patching is not immediately possible, follow the vendor's KB 4379499 mitigation guidance or restrict/disable SSO authentication until the appliance is updated.
• Remove KACE SMA management interfaces from direct internet exposure; place them behind VPN or an access-controlled reverse proxy.
• Audit and rotate credentials and API keys used by the appliance, and review local and SSO-linked accounts for unauthorized additions.
• Apply CISA KEV required actions and BOD 22-01 guidance, including discontinuing use if mitigations are unavailable.

Detection

• Review KACE SMA authentication and SSO logs for successful logins without a preceding credential or SSO assertion, and for logins from unexpected source IPs or user agents.
• Monitor for new or modified administrative accounts, role changes, and unexpected script, patch or agent deployment tasks on the appliance.
• Alert on outbound connections from the SMA to unusual destinations, which may indicate post-exploitation activity.
• Correlate appliance audit logs with downstream endpoint management actions to spot unauthorized mass deployment or configuration changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.