Quest KACE Systems Management Appliance (SMA) SSO Authentication Bypass and Administrative Takeover (CVE-2025-32975)

1. Apply Official Security Patches

Apply the appropriate security updates provided by Quest immediately:

• For 13.0.x: Upgrade to 13.0.385 or later
• For 13.1.x: Upgrade to 13.1.81 or later
• For 13.2.x: Upgrade to 13.2.183 or later
• For 14.0.x: Upgrade to 14.0.341 (Patch 5) or later
• For 14.1.x: Upgrade to 14.1.101 (Patch 4) or later

2. Temporary Mitigations

If immediate patching is not feasible, implement the following workarounds:

• Network Access Control: Restrict access to the KACE SMA admin portal. Ensure it is not exposed to the public internet and is only accessible via trusted internal networks or secure VPNs.
• Disable SSO Integration: Temporarily disable SSO authentication features on the appliance until the patch is applied, reverting to local authentication with Multi-Factor Authentication (MFA) enabled.

A critical authentication bypass vulnerability (CVE-2025-32975) has been identified in the Quest KACE Systems Management Appliance (SMA). This vulnerability has received a CVSS score of 10.0 and is actively exploited in the wild, leading to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Root Cause & Exploit Mechanics (CWE-287)

The vulnerability resides within the Single Sign-On (SSO) authentication handling mechanism of the KACE SMA. By sending specially crafted HTTP requests, an unauthenticated remote attacker can bypass the authentication verification process entirely. This allows the attacker to impersonate legitimate users and establish an active session without providing any valid credentials.

Impact

Successful exploitation of this vulnerability grants the attacker full administrative control over the affected KACE SMA instance. Since KACE SMA is a centralized systems management solution used to deploy software and manage enterprise endpoints, a compromise of this appliance can serve as a launchpad for lateral movement, ransomware deployment, and full-scale network compromise.