Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-32975 | Authentication Bypass in Quest KACE Systems Management Appliance (SSO) Quest KACE Systems Management Appliance (SMA) versions in the 13.0.x through 14.1.x branches, prior to the fixed builds, contain an improper authentication flaw (CWE-287) in the SSO authentication handling mechanism. Because the bypass requires no valid credentials, privileges, or user interaction and is reachable over the network, an attacker who can reach the appliance can impersonate legitimate users and achieve complete administrative takeover. Any organization running an affected SMA build is exposed, particularly where the appliance's web interface is reachable from untrusted networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-20, and press reporting describes attackers hijacking unpatched SMA systems, with compromises at roughly 60 organizations cited; ransomware use is not yet confirmed. Do: Upgrade affected SMA deployments to the fixed build for their branch — 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5), or 14.1.101 (Patch 4) or later — prioritizing internet-facing appliances. Since the flaw is actively exploited and grants full admin takeover, review appliance logs and administrator accounts for signs of compromise (unexpected SSO sessions, new or altered accounts) and restrict access to the SMA web interface to trusted networks per Quest's guidance. U.S. federal agencies must apply the required mitigations or discontinue use under BOD 22-01 by the KEV deadline. | 10.0 | 2% | KEV |
| largetens of thousands of deployed SMA appliances worldwide, with likely only a low-thousands subset internet-exposed |
Full article313 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 23, 2026Vulnerability / Endpoint Security
Threat actors are suspected to be exploiting a maximum-severity security flaw impacting Quest KACE Systems Management Appliance (SMA), according to Arctic Wolf.
The cybersecurity company said it observed malicious activity starting the week of March 9, 2026, in customer environments that's consistent with the exploitation of CVE-2025-32975 on unpatched SMA systems exposed to the internet. It's currently not known what the end goals of the attack are.
CVE-2025-32975 (CVSS score: 10.0) refers to an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. Successful exploitation of the flaw could facilitate the complete takeover of administrative accounts. The issue was patched by Quest in May 2025.
In the malicious activity detected by Arctic Wolf, threat actors are believed to have weaponized the vulnerability to seize control of administrative accounts and execute remote commands to drop Base64-encoded payloads from an external server (216.126.225[.]156) via the curl command.
The unknown attackers then proceeded to create additional administrative accounts via "runkbot.exe," a background process associated with the SMA Agent that's used to run scripts and manage installations. Also detected were Windows Registry modifications via a PowerShell script for possible persistence or system configuration changes.
Other actions undertaken by the threat actors are listed below -
- Conducting credential harvesting using Mimikatz.
- Performing discovery and reconnaissance by enumerating logged-in users and administrator accounts, and running "net time" and "net group" commands.
- Obtaining remote desktop protocol (RDP) access to backup infrastructure (Veeam, Veritas) and domain controllers.
To counter the threat, administrators are advised to apply the latest updates and avoid exposing SMA instances to the internet. The issue has been addressed in versions 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5), and 14.1.101 (Patch 4).
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/03/hackers-exploit-cve-2025-32975-cvss-100.html