# CVE-2025-32975: Quest KACE Systems Management Appliance authentication bypass in SSO

Source: https://junglewise.ai/threats/cve-2025-32975-quest-kace-systems-management-appliance-authentication-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-20. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-32975 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-04-20

Quest KACE Systems Management Appliance (SMA) is a tool used by organizations to manage and secure computers, servers, and connected devices. A critical security flaw allows unauthorized individuals to bypass login requirements and impersonate legitimate users, including administrators. This could lead to a complete takeover of the management system, allowing attackers to access sensitive data or disrupt IT operations across the entire network.

Technologies: [Quest KACE Systems Management Appliance](https://junglewise.ai/threats/technologies/kace-systems-management-appliance), [Quest KACE Systems Management Appliance (SMA)](https://junglewise.ai/threats/technologies/kace-systems-management-appliance-sma). Vendors: [Quest](https://junglewise.ai/threats/vendors/quest).

## Quick answers

**Is CVE-2025-32975 exploited in the wild?** Yes. CVE-2025-32975 is known to be exploited in the wild, first recorded on 20 April 2026. Treat it as urgent.

**How severe is CVE-2025-32975?** Critical severity, with a CVSS score of 10, published 20 April 2026.

**Which products and versions are affected?** Quest KACE Systems Management Appliance 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4).

**Is there a fix for CVE-2025-32975?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-32975 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-32975?** Check whether you run Quest KACE Systems Management Appliance or Quest KACE Systems Management Appliance (SMA) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authentication vulnerability (CWE-287) exists in the Single Sign-On (SSO) authentication handling mechanism of the Quest KACE Systems Management Appliance (SMA). The flaw allows a remote, unauthenticated attacker to bypass security checks and impersonate any legitimate user, including those with administrative privileges. This vulnerability is exploitable over the network without user interaction. Successful exploitation results in a complete administrative takeover of the appliance. Patches have been released for versions 13.0, 13.1, 13.2, 14.0, and 14.1.

## Affected products

- Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4)

## Timeline

- 2025-06-24: disclosed: Initial CVE publication
- 2026-04-20: kev added: Added to CISA Known Exploited Vulnerabilities catalog

## Related threats

- [Quest KACE SMA rate limit bypass in API login](https://junglewise.ai/threats/cve-2021-32088-quest-kace-sma-rate-limit-bypass-in-api-login)
- [Quest KACE SMA default credentials in FTP service](https://junglewise.ai/threats/cve-2021-32087-quest-kace-sma-default-credentials-in-ftp-service)
- [Quest KACE SMA hardcoded symmetric encryption key](https://junglewise.ai/threats/cve-2021-32086-quest-kace-sma-hardcoded-symmetric-encryption-key)
- [Quest KACE SMA default credentials in MySQL database](https://junglewise.ai/threats/cve-2021-32085-quest-kace-sma-default-credentials-in-mysql-database)
- [Quest KACE SMA access control bypass in API endpoints](https://junglewise.ai/threats/cve-2021-32084-quest-kace-sma-access-control-bypass-in-api-endpoints)