Exploitation Summary
CVE-2025-32975 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 20, 2026.
Description
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.
References (5)
Core 5
Core References
Third Party Advisory, US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32975
Various Sources
https://seralys.com/research/CVE-2025-32975.txt
Various Sources
https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978
Mailing List
https://seclists.org/fulldisclosure/2025/Jun/22
Mailing List
http://seclists.org/fulldisclosure/2025/Jun/25
Scores
CVSS v3
10.0
EPSS
0.3931
EPSS Percentile
97.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
active
Automatable
yes
Technical Impact
total
Details
CISA KEV
2026-04-20
VulnCheck KEV
2026-03-19
ENISA EUVD
EUVD-2025-19028
CWE
CWE-287
Status
published
Products (1)
quest/kace_systems_management_appliance
13.0 - 13.0.385
Published
Jun 24, 2025
KEV Added
Apr 20, 2026
Tracked Since
Feb 18, 2026