CVE-2025-32975 is an authentication-bypass flaw in the single sign-on handling of Quest KACE Systems Management Appliance (SMA) that lets an attacker impersonate any legitimate user without valid credentials, giving complete administrative takeover of the appliance; it was privately reported, patched by Quest, and later confirmed exploited and added to CISA's KEV catalog.
Vulnerability summary
| Vulnerability ID | CVE-2025-32975 |
|---|---|
| CVSS score | 10 |
| EPSS score | 0.0249 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD (CISA-ADP Secondary score only, not NVD Primary) |
| Published | 2025-06-24T15:15:23.710 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Quest KACE Systems Management Appliance (SMA) | cpe:2.3:a:quest:kace_systems_management_appliance:*:*:*:*:*:*:*:* | 13.0.x before 13.0.385; 13.1.x before 13.1.81; 13.2.x before 13.2.183; 14.0.x before 14.0.341 (Patch 5); 14.1.x before 14.1.101 (Patch 4) |
What this means
CVE-2025-32975 is an improper authentication vulnerability (CWE-287) in Quest KACE Systems Management Appliance (SMA), an enterprise endpoint- and systems-management platform. NVD's description states: "Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover" (NVD).
NVD lists only a Secondary CVSS v3.1 submission from CISA-ADP (CISA's Authorized Data Publisher role): 10.0 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. NVD's own vulnerability status is "Analyzed," but no NVD Primary CVSS metric has been published for this CVE, so per our indexing policy that 10.0 figure is labelled not NVD-confirmed. NVD's own SSVC assessment, also sourced from CISA-ADP, separately records exploitation: active, automatable: yes and technicalImpact: total (NVD).
The discovering researchers, Philippe Caturegli and Mohamed Mahmoudi of Seralys, published a full-disclosure advisory (fetched this run) confirming the vulnerability lies in KACE SMA's SSO authentication handling and "can result in complete administrative takeover," while withholding exploitation technical detail and PoC code for a 90-day embargo period. The advisory's disclosure timeline: Quest was notified 2025-04-14, Quest shipped a public hotfix 2025-05-27, and Seralys published its public advisory 2025-06-23 — one day after NVD's own publication date. Seralys independently lists the same affected/fixed version boundaries as NVD: vulnerable through 14.1 and earlier, fixed in 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5) and 14.1.101 (Patch 4) (Seclists full-disclosure post; Seralys research advisory). Quest's own response page for this and three related CVEs (CVE-2025-32976/32977/32978) is linked from NVD's references but renders its content client-side and returned no readable text when fetched this run.
CISA added CVE-2025-32975 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-20, roughly ten months after public disclosure, with a required-action due date of 2026-05-04; known ransomware-campaign use is listed as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.0249 (84.58th percentile) (FIRST EPSS).
Because this flaw gives unauthenticated administrative takeover of an endpoint-management appliance — a platform typically trusted to push software and scripts to every managed endpoint — any KACE SMA instance below the patched builds above should be upgraded immediately and audited for unauthorized admin accounts, scheduled tasks or software deployments created since the appliance was last known-good.
Evidence
- Quest KACE SMA 13.0.x-14.1.x before specific patched builds contains an SSO authentication bypass letting attackers impersonate legitimate users without credentials, leading to complete administrative takeover. — NVD
- Only a Secondary CVSS v3.1 10.0 (CRITICAL) score from CISA-ADP is published; no NVD Primary metric exists. CISA-ADP's SSVC data separately marks exploitation as active, automatable, with total technical impact. — NVD
- Disclosure timeline: Quest notified 2025-04-14, public hotfix shipped 2025-05-27, Seralys public advisory 2025-06-23; researchers Philippe Caturegli and Mohamed Mahmoudi. — Seclists full-disclosure post
- Vulnerable through version 14.1 and earlier; fixed in 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5) and 14.1.101 (Patch 4), matching NVD's version data. — Seralys research advisory
- Added to the CISA KEV catalog on 2026-04-20, due date 2026-05-04; known ransomware campaign use listed as Unknown. — CISA KEV
- EPSS score is 0.0249 (84.58th percentile) as of 2026-10-29. — FIRST EPSS