{"id":"CVE-2025-32975","published":"2025-06-24T15:15:23Z","modified":"2026-06-17T09:12:53Z","title":"Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability","vendor":"Quest","product":"KACE Systems Management Appliance (SMA)","tier":"core","eol":null,"description":{"text":"Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.","provenance":"source","from":"NVD"},"summary":{"text":"Quest KACE Systems Management Appliance (SMA) contains an authentication bypass flaw in its SSO authentication handling mechanism, affecting releases before 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5), and 14.1.101 (Patch 4). An attacker can impersonate legitimate users without valid credentials over the network, with no authentication or user interaction required, potentially gaining complete administrative control.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:41Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.02487,"percentile":0.84581,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2026-04-20","dueDate":"2026-05-04","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978 ; https://nvd.nist.gov/vuln/detail/CVE-2025-32975","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-03-19","exploitedFirstSeen":"2026-03-19","ransomware":false,"evidence":[{"url":"https://arcticwolf.com/resources/blog/cve-2025-32975/","date":"2026-03-19"},{"url":"https://x.com/CCBalert/status/2035047235382046869","date":"2026-03-20"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-04-20"},{"url":"https://hunt.io/blog/cve-2025-32975-quest-kace-sma-open-directory-60-victims","date":"2026-05-12"},{"url":"https://cyble.com/reports/H1-2026-Global-Threat-Landscape-Report.pdf","date":"2026-07-27"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)","url":"https://otx.alienvault.com/pulse/6ae253860a3b367f68c51cd8","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)","url":"https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://seclists.org/fulldisclosure/2025/Jun/22","tags":["Mailing List","Third Party Advisory"]},{"url":"https://seralys.com/research/CVE-2025-32975.txt","tags":["Third Party Advisory"]},{"url":"https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978","tags":["Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Jun/25","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32975","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated exploit of public-facing appliance","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"contains an authentication bypass vulnerability that allows attackers","start":188,"end":257}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Impersonation yields valid account access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows attackers to impersonate legitimate users without valid credentials","start":241,"end":315}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-19028","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19028","exploited":true,"exploitedSince":"2026-04-20","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2025-06-24","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32975","provenance":"source"},{"date":"2026-03-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://arcticwolf.com/resources/blog/cve-2025-32975/","provenance":"source"},{"date":"2026-04-20","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-04-20","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19028","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":300},"priority":{"score":66.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 225 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.92,"detail":"percentile 0.8458"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}