Quest KACE SMA sign-in bypass CVE-2025-32975 used in attacks; fixes available
Attackers are exploiting CVE-2025-32975 to impersonate users of Quest KACE SMA, a business computer-management appliance. Fixes have been available since 2025. Ask IT to install a supported, patched release and remove direct internet access.
If your business or family office uses KACE SMA, ask its IT provider to install a supported release containing Quest’s security fixes and restrict access through a VPN or firewall. Quest warns that the 13.x hotfix must be reapplied after each full 13.x upgrade. Ask IT to investigate possible compromise if an unpatched appliance was exposed to the internet.
What’s happening
CVE-2025-32975 lets attackers impersonate legitimate users, including administrators, without valid credentials on vulnerable Quest KACE Systems Management Appliances. Organisations use these appliances to deploy software, install updates and manage computers, making a takeover consequential for the devices they control. Quest released fixes in May 2025 across the affected 13.x and 14.x branches. Arctic Wolf reported suspected exploitation of exposed, unpatched appliances beginning in March 2026, with credential theft and movement into other business systems. CISA confirmed exploitation by listing the flaw on 20 April. In May, Hunt.io reported a stolen management database from IT provider HIQ containing endpoint information for more than 60 client organisations. That finding does not prove all those clients were breached. As at 3 November 2026, fixes are available; the reviewed sources do not establish the full number of victims or that attacks have ended.
- What
- Flaw
- Affects
- Quest KACE Systems Management Appliance (SMA)
- Affected
- KACE SMA 13.0.x before 13.0.385
KACE SMA 13.1.x before 13.1.81
KACE SMA 13.2.x before 13.2.183
KACE SMA 14.0.x before 14.0.341 (Patch 5)
KACE SMA 14.1.x before 14.1.101 (Patch 4) - Fixed in
- KACE SMA 13.0.385 with the supplied security hotfix
KACE SMA 13.1.81 with the supplied security hotfix
KACE SMA 13.2.183 with the supplied security hotfix
KACE SMA 14.0.341 (Patch 5)
KACE SMA 14.1.101 (Patch 4) - Since
- 20 Apr 2026
- Closed
- 12 May 2026
Timeline
- Update
Hunt.io reported finding a stolen KACE database belonging to managed IT provider HIQ. The database contained information about endpoints managed for more than 60 client organisations; this did not establish that every client had been compromised.
- CISA added
CISA added CVE-2025-32975 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. Belgium’s Centre for Cybersecurity documented the addition in its 21 April update.
- Made public
Arctic Wolf reported suspected exploitation on internet-facing, unpatched appliances beginning in the week of 9 March. It observed administrative takeover, credential theft and access to backup systems and domain controllers.
- Vendor revised
Quest confirmed hotfixes for KACE SMA 13.0, 13.1 and 13.2, plus cumulative patches for 14.0 and 14.1. It said there was no evidence of compromised appliances at that time.
- New fixFixed
Quest published its advisory and fixes for CVE-2025-32975 and three related KACE SMA vulnerabilities, according to Hunt.io’s subsequent chronology.
Sources
- Quest response to KACE SMA vulnerabilities — KB 4379499Quest · 19 June 2025
- KACE SMA resolution to critical vulnerabilitiesQuest · 10 June 2025
- CVE-2025-32975: Arctic Wolf observes exploitation of Quest KACE Systems Management ApplianceArctic Wolf · 19 Mar 2026
- Quest KACE SMA vulnerability warning — updated with CISA exploitation listingCentre for Cybersecurity Belgium · 21 Apr 2026
- CVE-2025-32975: The open directory behind the KACE SMA breach and 60+ downstream victimsHunt.io · 12 May 2026