Overview

CVE-2025-32975 is a critical authentication bypass vulnerability (CWE-287: Improper Authentication) in Quest KACE Systems Management Appliance (SMA). It allows an unauthenticated remote attacker to impersonate legitimate users, including administrators, without providing valid credentials.

The flaw affects the SSO authentication handling mechanism and can lead to full administrative takeover of the appliance. CVSS score: 10.0 (Critical). Patched in May 2025, but active exploitation was observed in 2026 on publicly exposed unpatched instances. Added to the CISA KEV catalog.

Affected versions

  • KACE SMA 13.0.x before 13.0.385
  • 13.1.x before 13.1.81
  • 13.2.x before 13.2.183
  • 14.0.x before 14.0.341 (and related builds)

Patches were released by Quest in May 2025. The vulnerability is particularly dangerous for internet-exposed appliances.

Technical breakdown (root cause)

The vulnerability lies in the SSO authentication processing logic of KACE SMA. The application insufficiently validates authentication tokens or session states during the SSO flow, allowing crafted requests to be treated as originating from already authenticated users (including admin).

This is a classic improper authentication flaw enabling user impersonation without valid credentials. When combined with related issues (e.g., CVE-2025-32976), it results in complete compromise.

Attack chain

  1. Attacker sends specially crafted requests to SSO endpoints on an exposed KACE SMA.
  2. Successfully impersonates a legitimate user (often an administrator) via the bypass.
  3. Gains full administrative access to the appliance.
  4. Leverages KACE capabilities (e.g., KPluginRunProcess) to execute remote commands, exfiltrate databases, and deploy payloads to managed endpoints.

Attacks were observed targeting the education sector and MSPs. Post-compromise activities included data exfiltration and lateral movement.

Detection guidance

  • Monitor KACE SMA logs for suspicious SSO requests and admin logins without standard authentication flows.
  • Detect unexpected command execution via KPluginRunProcess.
  • Watch for access to the admin interface from unusual IPs or sources.
  • Look for post-exploitation indicators: new admin accounts, large database dumps, or script execution on managed endpoints.
  • Network signatures for anomalous SSO traffic.

Indicators of compromise

  • Suspicious requests to SSO endpoints.
  • Creation of new administrative accounts (e.g., kace_admin).
  • Database dumps or large data exfiltration.
  • Command execution patterns through KACE.

Specific IOCs (IPs, hashes) are detailed in Arctic Wolf, Hunt.io, and Quest reports.

Mitigation

  • Upgrade immediately to the patched versions (13.0.385+, 13.1.81+, etc.).
  • Restrict public internet access to KACE SMA (place behind VPN, firewall rules, or WAF).
  • Enable multi-factor authentication and comprehensive logging/auditing.
  • Regularly scan and inventory internet-facing instances for outdated versions.
  • Follow Quest hardening recommendations.

Given KACE SMA's role as a centralized endpoint management platform, compromise of a single appliance can lead to widespread impact across the environment. Urgent patching and forensic review are strongly recommended for exposed systems.