Quest · Auth bypass
Quest KACE Systems Management Appliance (SMA) Authentication Bypass Vulnerability
At a glance
Actively exploited in the wild — prioritise confirming exposure.
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on Quest KACE Systems Management Appliance (SMA), treat it as High.
Briefing
There is no written leader briefing for this story yet. These questions come from the facts we hold.
Questions to ask IT
- Do we run Quest KACE Systems Management Appliance (SMA), and which versions?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 16 Nov?
Next steps
- Confirm exposure, mitigation status and any service interruption risk.
Vulnerability facts
Full CVE detail CVE-2025-32975- 10.0 · CriticalExploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Listed: attacks using it have been seen (on the catalogue since )
- ~2.5% estimated chance of attack in 30 days
- 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341, 14.1.x before 14.1.101
- 13.0.385, 13.1.81, 13.2.183, 14.0.341, 14.1.101
These facts are for CVE-2025-32975. This event covers 3 more CVEs, each with its own record. Versions are as the CVE record states them; check the vendor advisory before planning a fix.
No technical write-up beyond these facts and the summary below yet.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.
- CVE-2025-32975 is listed in known-exploited catalogue (exploitation in the wild)
- Authoritative catalogues report active exploitation of this vulnerability.
Why this matters in the UK
- Known-exploited catalogue reports exploitation in the wild
Products and services involved
- Quest KACE Systems Management Appliance (SMA)82% match confidence · CVE-2025-32975
Part of Apple and third-party product vulnerabilities
Pulse
Last checked 40m ago · Next recheck 14 Nov 2026, 00:10 UK time · 1 quiet check collapsed
in the next 30 days first recorded at 2.5% (lower likelihood signal, not confirmed exploitation).
recorded — watch for changes; not confirmed exploitation.
2 quiet checks hidden.
Sources
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ConfirmedHeadline90% confidence
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
- ConfirmedSummary fact75% confidence
Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials. Affects Quest KACE Systems Management Appliance (SMA). Known ransomware campaign use: Unknown. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2025-32975
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2025-32975 is listed in known-exploited catalogue (exploitation in the wild)
- ConfirmedCVE identifier95% confidence
Event involves CVE-2025-32976
- ConfirmedCVE identifier95% confidence
Event involves CVE-2025-32977
- ConfirmedCVE identifier95% confidence
Event involves CVE-2025-32978