Quest KACE SMA CVE-2025-32975: SSO Auth Bypass Exploited
The fix is from May 2025, but attackers used this bug in March 2026 against exposed, unpatched KACE appliances to push commands to managed Windows hosts; confirm every SMA is on a fixed build, off the internet, and hunt for the March 2026 activity.
Must act: Organizations running Quest KACE Systems Management Appliance, above all any whose web interface has been reachable from the internet at any point since mid-2025.
Can relax: Teams that do not use KACE SMA, and KACE customers who patched in mid-2025, never exposed the appliance publicly and find nothing in the hunt below.
- Check the version of every KACE SMA and upgrade anything below 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5) or 14.1.101 (Patch 4).
- Remove internet exposure of the SMA web interface; put it behind a VPN or an IP allowlist.
- Review SMA administrator accounts and scripts for anything you did not create.