← CVE Radar
CVE-2025-32975Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.
10.0 CRITICALEPSS 2.48%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 10.0 | CRITICAL | 3.1CISA-ADP | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due May 4, 2026
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2025-32975
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Jun 24, 2025
- Last modified
- 2026-06-17 09:12 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
questkace systems management appliance5 version ranges
- 13.0 before 13.0.385
- 13.1 before 13.1.81
- 13.2 before 13.2.183
- 14.0 before 14.0.341
- 14.1 before 14.1.101
References
- seclists.org https://seclists.org/fulldisclosure/2025/Jun/22
- seralys.com https://seralys.com/research/CVE-2025-32975.txt
- support.quest.com https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978
- seclists.org http://seclists.org/fulldisclosure/2025/Jun/25
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32975