---
title: "Quest KACE SMA CVE-2025-32975: SSO Auth Bypass Exploited"
url: https://erroneo.us/security/briefs/quest-kace-sma-cve-2025-32975-sso-auth-bypass/
description: "CVSS 10 SSO bypass in Quest KACE SMA, patched May 2025, hit exposed appliances in March 2026 and joined KEV. Confirm fixed builds and hunt agent commands."
type: security-brief
section: "Security Digest"
date_published: 2025-05-27
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-32975"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Quest KACE SMA CVE-2025-32975: SSO Auth Bypass Exploited

**Verdict: Check exposure.** The fix is from May 2025, but attackers used this bug in March 2026 against exposed, unpatched KACE appliances to push commands to managed Windows hosts; confirm every SMA is on a fixed build, off the internet, and hunt for the March 2026 activity.

- **Who must act:** Organizations running Quest KACE Systems Management Appliance, above all any whose web interface has been reachable from the internet at any point since mid-2025.
- **Who can relax:** Teams that do not use KACE SMA, and KACE customers who patched in mid-2025, never exposed the appliance publicly and find nothing in the hunt below.
- **Affected:** KACE SMA 13.0.x before 13.0.385; KACE SMA 13.1.x before 13.1.81; KACE SMA 13.2.x before 13.2.183; KACE SMA 14.0.x before 14.0.341 (Patch 5); KACE SMA 14.1.x before 14.1.101 (Patch 4)
- **Fixed:** 13.0.385; 13.1.81; 13.2.183; 14.0.341 (Patch 5); 14.1.101 (Patch 4)
- **CVEs:** CVE-2025-32975
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the version of every KACE SMA and upgrade anything below 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5) or 14.1.101 (Patch 4).
2. Remove internet exposure of the SMA web interface; put it behind a VPN or an IP allowlist.
3. Review SMA administrator accounts and scripts for anything you did not create.
4. Hunt managed endpoints for the March 2026 attack pattern: runkbot.exe spawning net, PowerShell or curl.
5. If you find signs of abuse, treat it as a domain-wide incident: reset privileged and backup-system credentials and check domain controllers.

### How to check if you are affected

- Search EDR data for runkbot.exe launching net.exe with 'localgroup administrators' or 'group "domain admins"', and for new local or domain accounts such as ooo1 and ooo2.
- Look for C:\temp\Enable-UpdateServices.ps1, taskband.ps1, a Mimikatz copy named asd.exe, and output files like c:\1.txt.
- Check KACE logs for Base64-encoded payloads run through KPluginRunProcess, and network logs for connections to 216.126.225.156.
- Review RDP logons to backup servers (Veeam, Veritas) and domain controllers that originate from KACE-managed hosts.

## What happened

CVE-2025-32975 is an authentication bypass (CWE-287) in the single sign-on handling of Quest KACE Systems Management Appliance (SMA). KACE SMA is an on-prem tool for inventory, patching and software distribution on Windows and other endpoints. Philippe Caturegli and Mohamed Mahmoudi of [Seralys](https://seralys.com/research/CVE-2025-32975.txt) reported it to Quest on April 14, 2025. Their advisory says an attacker can impersonate "any valid username" without credentials, up to "full administrative access to the appliance." Quest released the fix on May 27, 2025, and Seralys published a high-level disclosure on June 23. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-32975) followed on June 24. Quest's response covers three companion bugs, CVE-2025-32976 through CVE-2025-32978. CISA's enrichment scores CVE-2025-32975 CVSS 3.1 10.0.

Exploitation came later. [Arctic Wolf](https://arcticwolf.com/resources/blog/cve-2025-32975/) reported on March 19, 2026, that starting the week of March 9 it saw malicious activity "potentially linked" to the bug on unpatched, internet-exposed appliances. Attackers ran remote commands through KACE's own `KPluginRunProcess` and pulled Base64-encoded payloads from `216.126.225.156` with curl. They used the agent process `runkbot.exe` to create admin accounts and harvested credentials with Mimikatz. They then used RDP to reach Veeam and Veritas backup servers and domain controllers. Arctic Wolf found no sign that the three companion CVEs were used. CISA added CVE-2025-32975 to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32975) on April 20, 2026, with a May 4 deadline. Ransomware use is listed as unknown.

## Who is affected

KACE SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4). Those are also the fixed builds.

## Do you really need to act?

If you run KACE SMA, check it. A fixed build has been out for 17 months, so a well-run appliance is already safe. The danger is in what the appliance controls. An endpoint manager pushes scripts and software to every managed machine by design. Admin access to the SMA is effectively admin access to your Windows fleet, which is exactly how the March 2026 intrusions spread. Arctic Wolf ties the activity to internet-exposed instances. An appliance that was public and unpatched in early 2026 needs a hunt, not just an upgrade. [The Hacker News](https://thehackernews.com/2026/03/hackers-exploit-cve-2025-32975-cvss-100.html) reported that the attackers' end goal was unknown. We found no later disclosure as of Oct 23, 2026.

## What to do now

1. Check the version shown in each SMA admin console and upgrade anything below the fixed builds above.
2. Take the SMA web interface off the internet. Arctic Wolf recommends VPN or firewall restrictions if remote access is needed.
3. Review SMA admin accounts, scripts and recent deployments for anything nobody on your team created.
4. Run the hunt below on managed endpoints, focusing on February through April 2026.
5. If you find activity, treat it as a domain compromise. Reset privileged credentials, including backup-system accounts, and review domain controllers.

## How to tell if you were hit

On managed Windows hosts, query EDR data for `runkbot.exe` starting `net.exe`, PowerShell or curl. Arctic Wolf saw `net localgroup administrators ooo1 /add` and `net group "domain admins" ooo2 /add`. Look for a hidden `C:\temp\Enable-UpdateServices.ps1`, a `taskband.ps1` registry script, a Mimikatz copy named `asd.exe`, and discovery output in `c:\1.txt`. Check network logs for `216.126.225.156`. [Field Effect](https://fieldeffect.com/blog/2025-quest-kace-sma-vulnerability-exploited) describes the same pattern of hidden PowerShell and registry changes.

## Timeline

- Apr 14, 2025 — Seralys reports the bug to Quest.
- May 27, 2025 — Quest releases the fix.
- Jun 23, 2025 — Seralys publishes a high-level advisory.
- Mar 9, 2026 — Arctic Wolf starts seeing related malicious activity.
- Mar 19, 2026 — Arctic Wolf publishes its report.
- Apr 20, 2026 — CISA adds the CVE to KEV.

## Sources

1. [Seralys — Security Advisory: Quest KACE SMA Authentication Bypass (CVE-2025-32975)](https://seralys.com/research/CVE-2025-32975.txt)
2. [CVE record — CVE-2025-32975](https://www.cve.org/CVERecord?id=CVE-2025-32975)
3. [CISA — Known Exploited Vulnerabilities: CVE-2025-32975](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32975)
4. [Arctic Wolf — CVE-2025-32975: Malicious activity potentially linked to exploitation of Quest KACE SMA](https://arcticwolf.com/resources/blog/cve-2025-32975/)
5. [Field Effect — Quest KACE SMA vulnerability exploited](https://fieldeffect.com/blog/2025-quest-kace-sma-vulnerability-exploited)
6. [The Hacker News — Hackers exploit CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA](https://thehackernews.com/2026/03/hackers-exploit-cve-2025-32975-cvss-100.html)

---
Source page: https://erroneo.us/security/briefs/quest-kace-sma-cve-2025-32975-sso-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt