CVE-2025-32975: Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability identified as CVE-2025-32975. The flaw could allow attackers to impersonate legitimate users without valid credentials. This matters for organizations that rely on the appliance to manage endpoints, because successful impersonation could grant unauthorized control over managed systems and the data they hold.

How it works

CWE-287 covers improper authentication, a class of weakness in which an application does not correctly verify the identity of a user or process before granting access to protected functions or data.

An attacker could abuse this weakness by supplying requests that the affected component accepts without performing the expected credential validation. The precise request format and any conditions required for success are not described in the available summary and must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

Quest KACE Systems Management Appliance (SMA) is typically deployed as an on-premises server that centralizes inventory, patching, and configuration tasks for Windows, macOS, and Linux endpoints.

• Inventory all instances by querying network ranges for the appliance’s management ports and by reviewing asset records or procurement documentation for Quest KACE SMA deployments.
• Compare installed versions and any custom authentication settings against the configurations listed in the vendor advisory.
• Examine authentication-related logs on the appliance and any connected identity providers for entries that show successful logins without corresponding credential events; retain these logs for at least 90 days to support later investigation.

How to remediate

Apply the vendor-supplied update or configuration change referenced in the official advisory as the primary remediation step.

• After patching, review and enforce the strongest available authentication methods supported by the appliance, such as certificate-based or multi-factor mechanisms where offered.
• Remove or disable any legacy authentication pathways that are no longer required.
• Confirm that the changes have been applied by re-running the version and configuration checks described in the detection section.

If you can't patch immediately

Until the vendor instructions can be followed, reduce exposure by placing the appliance behind network segmentation that limits inbound connections to only the management workstations that require access.

• Monitor authentication logs and network flows to and from the appliance for anomalous patterns, such as logins from unexpected source addresses.
• If the affected functionality can be disabled without disrupting operations, do so until a patch is available.
• For any cloud-hosted components, follow the applicable requirements in CISA BOD 22-01.
• Discontinue use of the product if no mitigations can be implemented.

If your data may have been exposed

Improper-authentication vulnerabilities that are actively exploited can lead to unauthorized access and subsequent data exposure. Organizations can run a free exposure scan of their email addresses against known breach data to determine whether any accounts have already appeared in public data sets.