{"id":"quest-kace-authentication-bypass-apr-2026","category":"patch","status":"closed","title":"Quest KACE SMA sign-in bypass CVE-2025-32975 used in attacks; fixes available","tldr":"Attackers are exploiting CVE-2025-32975 to impersonate users of Quest KACE SMA, a business computer-management appliance. Fixes have been available since 2025. Ask IT to install a supported, patched release and remove direct internet access.","summary":"CVE-2025-32975 lets attackers impersonate legitimate users, including administrators, without valid credentials on vulnerable Quest KACE Systems Management Appliances. Organisations use these appliances to deploy software, install updates and manage computers, making a takeover consequential for the devices they control. Quest released fixes in May 2025 across the affected 13.x and 14.x branches. Arctic Wolf reported suspected exploitation of exposed, unpatched appliances beginning in March 2026, with credential theft and movement into other business systems. CISA confirmed exploitation by listing the flaw on 20 April. In May, Hunt.io reported a stolen management database from IT provider HIQ containing endpoint information for more than 60 client organisations. That finding does not prove all those clients were breached. As at 3 November 2026, fixes are available; the reviewed sources do not establish the full number of victims or that attacks have ended.","action":"If your business or family office uses KACE SMA, ask its IT provider to install a supported release containing Quest’s security fixes and restrict access through a VPN or firewall. Quest warns that the 13.x hotfix must be reapplied after each full 13.x upgrade. Ask IT to investigate possible compromise if an unpatched appliance was exposed to the internet.","product":"Quest KACE Systems Management Appliance (SMA)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2025-32975"],"tags":["quest","kace","authentication-bypass","actively-exploited","endpoint-management"],"affected":["KACE SMA 13.0.x before 13.0.385","KACE SMA 13.1.x before 13.1.81","KACE SMA 13.2.x before 13.2.183","KACE SMA 14.0.x before 14.0.341 (Patch 5)","KACE SMA 14.1.x before 14.1.101 (Patch 4)"],"fixed":["KACE SMA 13.0.385 with the supplied security hotfix","KACE SMA 13.1.81 with the supplied security hotfix","KACE SMA 13.2.183 with the supplied security hotfix","KACE SMA 14.0.341 (Patch 5)","KACE SMA 14.1.101 (Patch 4)"],"matches":[],"sources":[{"kind":"advisory","title":"Quest response to KACE SMA vulnerabilities — KB 4379499","url":"https://support.quest.com/it-it/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978","by":"Quest","date":"2025-06-19"},{"kind":"post","title":"KACE SMA resolution to critical vulnerabilities","url":"https://changelog.kace.com/posts/2025/2025-06-10-sma-cve/","by":"Quest","date":"2025-06-10"},{"kind":"research","title":"CVE-2025-32975: Arctic Wolf observes exploitation of Quest KACE Systems Management Appliance","url":"https://arcticwolf.com/resources/blog/cve-2025-32975/","by":"Arctic Wolf","date":"2026-03-19"},{"kind":"advisory","title":"Quest KACE SMA vulnerability warning — updated with CISA exploitation listing","url":"https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-found-quest-kace-systems-management-appliance-patch","by":"Centre for Cybersecurity Belgium","date":"2026-04-21"},{"kind":"research","title":"CVE-2025-32975: The open directory behind the KACE SMA breach and 60+ downstream victims","url":"https://hunt.io/blog/cve-2025-32975-quest-kace-sma-open-directory-60-victims","by":"Hunt.io","date":"2026-05-12"}],"started":"2026-04-20","closed":"2026-05-12","created":"2026-11-03T22:23:27.494Z","updated":"2026-11-03T22:23:27.494Z","cve_notes":[{"cve":"CVE-2025-32975","name":"Authentication bypass in Quest KACE SMA","what":"A flaw in Quest KACE SMA’s sign-in handling lets an attacker impersonate legitimate users without valid credentials and gain administrative access to the appliance.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-05-12","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Hunt.io reported finding a stolen KACE database belonging to managed IT provider HIQ. The database contained information about endpoints managed for more than 60 client organisations; this did not establish that every client had been compromised.","url":"https://hunt.io/blog/cve-2025-32975-quest-kace-sma-open-directory-60-victims","by":"Hunt.io","patch":null},{"at":"2026-04-20","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2025-32975 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. Belgium’s Centre for Cybersecurity documented the addition in its 21 April update.","url":"https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-found-quest-kace-systems-management-appliance-patch","by":"Centre for Cybersecurity Belgium","patch":null},{"at":"2026-03-19","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Arctic Wolf reported suspected exploitation on internet-facing, unpatched appliances beginning in the week of 9 March. It observed administrative takeover, credential theft and access to backup systems and domain controllers.","url":"https://arcticwolf.com/resources/blog/cve-2025-32975/","by":"Arctic Wolf","patch":null},{"at":"2025-06-10","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Quest confirmed hotfixes for KACE SMA 13.0, 13.1 and 13.2, plus cumulative patches for 14.0 and 14.1. It said there was no evidence of compromised appliances at that time.","url":"https://changelog.kace.com/posts/2025/2025-06-10-sma-cve/","by":"Quest","patch":null},{"at":"2025-05-27","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Quest published its advisory and fixes for CVE-2025-32975 and three related KACE SMA vulnerabilities, according to Hunt.io’s subsequent chronology.","url":"https://hunt.io/blog/cve-2025-32975-quest-kace-sma-open-directory-60-victims","by":"Hunt.io","patch":"patched"}],"url":"https://hard.fyi/live/quest-kace-authentication-bypass-apr-2026/","json":"https://hard.fyi/api/live?id=quest-kace-authentication-bypass-apr-2026"}