Quest KACE SMA CVE-2025-32975: SSO Auth Bypass Exploited

What to do

1. Check the version of every KACE SMA and upgrade anything below 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5) or 14.1.101 (Patch 4).
2. Remove internet exposure of the SMA web interface; put it behind a VPN or an IP allowlist.
3. Review SMA administrator accounts and scripts for anything you did not create.
4. Hunt managed endpoints for the March 2026 attack pattern: runkbot.exe spawning net, PowerShell or curl.
5. If you find signs of abuse, treat it as a domain-wide incident: reset privileged and backup-system credentials and check domain controllers.

How to check if you are affected or compromised

• Search EDR data for runkbot.exe launching net.exe with 'localgroup administrators' or 'group "domain admins"', and for new local or domain accounts such as ooo1 and ooo2.
• Look for C:\temp\Enable-UpdateServices.ps1, taskband.ps1, a Mimikatz copy named asd.exe, and output files like c:\1.txt.
• Check KACE logs for Base64-encoded payloads run through KPluginRunProcess, and network logs for connections to 216.126.225.156.
• Review RDP logons to backup servers (Veeam, Veritas) and domain controllers that originate from KACE-managed hosts.

What happened#

CVE-2025-32975 is an authentication bypass (CWE-287) in the single sign-on handling of Quest KACE Systems Management Appliance (SMA). KACE SMA is an on-prem tool for inventory, patching and software distribution on Windows and other endpoints. Philippe Caturegli and Mohamed Mahmoudi of Seralys reported it to Quest on April 14, 2025. Their advisory says an attacker can impersonate "any valid username" without credentials, up to "full administrative access to the appliance." Quest released the fix on May 27, 2025, and Seralys published a high-level disclosure on June 23. The CVE record followed on June 24. Quest's response covers three companion bugs, CVE-2025-32976 through CVE-2025-32978. CISA's enrichment scores CVE-2025-32975 CVSS 3.1 10.0.

Exploitation came later. Arctic Wolf reported on March 19, 2026, that starting the week of March 9 it saw malicious activity "potentially linked" to the bug on unpatched, internet-exposed appliances. Attackers ran remote commands through KACE's own KPluginRunProcess and pulled Base64-encoded payloads from 216.126.225.156 with curl. They used the agent process runkbot.exe to create admin accounts and harvested credentials with Mimikatz. They then used RDP to reach Veeam and Veritas backup servers and domain controllers. Arctic Wolf found no sign that the three companion CVEs were used. CISA added CVE-2025-32975 to the KEV catalog on April 20, 2026, with a May 4 deadline. Ransomware use is listed as unknown.

Who is affected#

KACE SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4). Those are also the fixed builds.

Do you really need to act?#

If you run KACE SMA, check it. A fixed build has been out for 17 months, so a well-run appliance is already safe. The danger is in what the appliance controls. An endpoint manager pushes scripts and software to every managed machine by design. Admin access to the SMA is effectively admin access to your Windows fleet, which is exactly how the March 2026 intrusions spread. Arctic Wolf ties the activity to internet-exposed instances. An appliance that was public and unpatched in early 2026 needs a hunt, not just an upgrade. The Hacker News reported that the attackers' end goal was unknown. We found no later disclosure as of Oct 23, 2026.

What to do now#

1. Check the version shown in each SMA admin console and upgrade anything below the fixed builds above.
2. Take the SMA web interface off the internet. Arctic Wolf recommends VPN or firewall restrictions if remote access is needed.
3. Review SMA admin accounts, scripts and recent deployments for anything nobody on your team created.
4. Run the hunt below on managed endpoints, focusing on February through April 2026.
5. If you find activity, treat it as a domain compromise. Reset privileged credentials, including backup-system accounts, and review domain controllers.

How to tell if you were hit#

On managed Windows hosts, query EDR data for runkbot.exe starting net.exe, PowerShell or curl. Arctic Wolf saw net localgroup administrators ooo1 /add and net group "domain admins" ooo2 /add. Look for a hidden C:\temp\Enable-UpdateServices.ps1, a taskband.ps1 registry script, a Mimikatz copy named asd.exe, and discovery output in c:\1.txt. Check network logs for 216.126.225.156. Field Effect describes the same pattern of hidden PowerShell and registry changes.

Timeline#

• Apr 14, 2025 — Seralys reports the bug to Quest.
• May 27, 2025 — Quest releases the fix.
• Jun 23, 2025 — Seralys publishes a high-level advisory.
• Mar 9, 2026 — Arctic Wolf starts seeing related malicious activity.
• Mar 19, 2026 — Arctic Wolf publishes its report.
• Apr 20, 2026 — CISA adds the CVE to KEV.

Vulnerability records

• CVE-2025-32975 · KEV 2026-04-20 · Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Seralys — Security Advisory: Quest KACE SMA Authentication Bypass (CVE-2025-32975) seralys.com
2. CVE record — CVE-2025-32975 cve.org
3. CISA — Known Exploited Vulnerabilities: CVE-2025-32975 cisa.gov
4. Arctic Wolf — CVE-2025-32975: Malicious activity potentially linked to exploitation of Quest KACE SMA arcticwolf.com
5. Field Effect — Quest KACE SMA vulnerability exploited fieldeffect.com

Coverage and analysis

1. The Hacker News — Hackers exploit CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA thehackernews.com