CVE-2025-32975: Quest KACE Systems Management Appliance Improper Authentication

Background

CVE-2025-32975 is a critical authentication bypass in Quest KACE Systems Management Appliance (SMA). Attackers can impersonate any legitimate user — including administrators — without providing valid credentials. CISA added this to the KEV catalogue on April 20, 2026.

The severity stems from what KACE SMA is: a centralised IT endpoint management platform that distributes software, enforces configurations, and runs scripts across every managed device. Authentication bypass on the management console is not just account compromise — it is a potential path to remote code execution on every device in the managed fleet.

Quest KACE Systems Management Appliance is an enterprise endpoint management platform used by IT teams to manage software deployment, patch management, asset inventory, scripting, and remote support across Windows, macOS, and Linux endpoints. A typical enterprise deployment has the KACE SMA managing hundreds to thousands of endpoints.

The appliance is typically deployed as a VM on-premises, with the web-based administrator console accessible on the internal network — and in some organisations, exposed to the broader internet or reachable via VPN.

Technical Mechanism

The vulnerability is classified as improper authentication — the server-side logic that validates whether a presented identity is legitimate is flawed. Successful exploitation allows an attacker to assume the identity of an existing user account without knowing that user’s credentials.

The specific mechanism has not been fully detailed in public disclosures, but authentication bypass vulnerabilities of this class typically fall into a few categories:

• Session token prediction or forgery: Session identifiers are generated in a predictable way or can be crafted without server-side secrets
• Missing authentication checks on specific endpoints: Certain API routes or administrative functions lack authentication enforcement
• Credential bypass via header manipulation: Authentication decisions based on request headers that can be attacker-controlled

Regardless of mechanism, the outcome is the same: an unauthenticated or low-privilege attacker can impersonate an administrator and access the full KACE SMA console.

# Representative authentication bypass pattern for header-manipulation class
# Attacker impersonates the built-in admin user without valid credentials
GET /api/v1/inventory HTTP/1.1
Host: kace-sma.internal.example.com
X-KACE-Authorization: admin
X-Forwarded-User: admin
Accept: application/json

# Alternatively, session token forgery pattern:
GET /userui/ HTTP/1.1
Host: kace-sma.internal.example.com
Cookie: kboxid=<forged-or-predicted-session-token>
Accept: text/html

# Once authenticated, deploy a malicious script to all managed endpoints:
POST /api/v1/script HTTP/1.1
Host: kace-sma.internal.example.com
Cookie: kboxid=<attacker-session>
Content-Type: application/json

{
  "name": "Maintenance Task",
  "run_on_all_devices": true,
  "script_type": "BATCH",
  "script_content": "powershell -enc <base64-encoded-payload>"
}

Real-World Exploitation Evidence

KACE SMA is an endpoint management system. Administrative access to the console provides:

• Software deployment to all managed endpoints: An attacker can package and deploy arbitrary executables to every KACE-managed machine
• Script execution across the fleet: KACE supports scripting (batch, PowerShell, shell) that runs on endpoints — any script an attacker deploys executes on managed machines
• Patch management manipulation: Patch deployment can be blocked or malicious packages disguised as legitimate patches
• Asset and credential data: KACE’s inventory database contains detailed information about every managed device, installed software, and user activity
• Remote control capabilities: Depending on deployment configuration, KACE’s remote support features may enable interactive access to managed endpoints

This means a single exploitation of CVE-2025-32975 can cascade into a mass compromise of an organisation’s entire managed endpoint population — a network-wide ransomware deployment scenario or large-scale credential harvesting operation.

Impact Assessment

Administrative access to a centralised endpoint management platform represents a cascading compromise risk. An attacker who gains console access can deploy malicious software or scripts to every managed endpoint simultaneously — the equivalent of conducting a network-wide ransomware deployment in a single automated action.

KACE SMA’s software deployment, scripting, and remote access capabilities are all available to an authenticated administrator. In environments managing hundreds or thousands of endpoints, this is among the highest-leverage positions an attacker can reach. The KACE inventory database also contains detailed device profiles, installed software inventories, and user activity records — intelligence that directly supports targeted follow-on attacks. A single appliance compromise equates to potential total loss of endpoint integrity across the managed fleet.

Affected Versions

Check your current KACE SMA version from the appliance web interface under Settings > Appliance Information.

Remediation Steps

Apply the Quest patch immediately. This is a critical-severity authentication bypass on a platform that controls your entire managed endpoint fleet — it should be treated as an emergency.

1. Download the KACE SMA patch from Quest’s support portal
2. Apply through the appliance update mechanism (Settings > Appliance Update)
3. Verify the updated version matches the fixed release in Quest’s advisory
4. Rotate administrator credentials after patching — assume any credentials accessible through the impersonation path may have been exfiltrated

Immediate network-level mitigations (if patching is delayed):

• Restrict access to the KACE SMA web console to known admin workstation IP addresses via firewall or network ACL
• Disable internet-facing access to the KACE SMA console entirely if it is not required
• Enable MFA on all administrator accounts if supported by the version in use

# Example firewall rule: restrict KACE SMA console to admin subnet only (Linux/iptables)
# Block all access to KACE web UI port from non-admin networks
iptables -I INPUT -p tcp --dport 443 -s 0.0.0.0/0 -j DROP
iptables -I INPUT -p tcp --dport 443 -s 10.0.1.0/24 -j ACCEPT   # admin workstation subnet only
iptables -I INPUT -p tcp --dport 80 -s 0.0.0.0/0 -j DROP
iptables -I INPUT -p tcp --dport 80 -s 10.0.1.0/24 -j ACCEPT

# Save rules (RHEL/CentOS)
service iptables save

Detection Guidance

Authentication bypass exploitation on KACE SMA may not produce obvious log entries since the attacker is masquerading as a legitimate user. Look for:

• Access from unexpected source IPs: KACE admin console logins from IPs outside the known administrator workstation range
• Unexpected software deployment jobs: New software packages or deployment policies created outside of normal change windows
• Script job creation: New scripting jobs, especially those targeting all managed devices, created by accounts that should not be creating them
• Access at unusual times: Administrative activity outside business hours for accounts that typically operate on predictable schedules

KACE SMA logs admin activity in the appliance’s built-in audit log (Reports > Admin Activity). Export and review logs for the period since the vulnerability was disclosed.

index=kace sourcetype="kace:audit"
(action="LOGIN" OR action="SCRIPT_CREATE" OR action="SOFTWARE_DEPLOY")
| eval is_known_admin_ip=if(match(src_ip, "^10\.0\.1\."), "yes", "no")
| where is_known_admin_ip="no" OR (action="SCRIPT_CREATE" AND target="ALL_DEVICES")
| stats count by src_ip, user, action, target, _time
| sort -_time

alert http any any -> $HOME_NET 443 (msg:"CVE-2025-32975 KACE SMA Auth Bypass - Suspicious Header"; flow:established,to_server; http.header; content:"X-KACE-Authorization"; nocase; sid:9002180; rev:1;)
alert http any any -> $HOME_NET 443 (msg:"CVE-2025-32975 KACE SMA Admin API Access from External"; flow:established,to_server; http.uri; content:"/api/v1/"; nocase; sid:9002181; rev:1;)
alert http any any -> $HOME_NET 443 (msg:"CVE-2025-32975 KACE SMA Bulk Script Deployment"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/script"; nocase; http.request_body; content:"run_on_all_devices"; nocase; sid:9002182; rev:1;)

Timeline

References

• NVD — CVE-2025-32975
• CISA KEV — CVE-2025-32975
• Quest Security Advisory — CVE-2025-32975