CyberSec.Space Logo
Back to CVE Browser

CVE-2025-32975

🔥 Known Exploited (CISA KEV)CRITICAL
10.0
CVSS Severity Score
EPSS Score29.5220%
EPSS Percentile81.20th
Published2025-06-24
Last Modified2026-06-17
Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.

Affected Platforms (CPE)

📦
Quest

Kace Systems Management Appliance

>= 13.0 and < 13.0.385>= 13.1 and < 13.1.81>= 13.2 and < 13.2.183>= 14.0 and < 14.0.341>= 14.1 and < 14.1.101

References & Advisories

🔗 https://seclists.org/fulldisclosure/2025/Jun/22
🔗 https://seralys.com/research/CVE-2025-32975.txt
🔗 https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978
🔗 http://seclists.org/fulldisclosure/2025/Jun/25
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32975

Related Security Intelligence Articles

Daily Global Cyber Threat Intelligence Digest — July 30, 2026

Today’s threat intelligence covers Ruby on Rails CVE-2026-66066 arbitrary file read, Gitea CVE-2026-60004 Git hook command execution, coordinated attacks on Minnesota water systems, Ruflo MCP Bridge RCE, and Firefox CVE-2026-10702.

2026-07-30

Daily Global Cyber Threat Intelligence Digest — July 29, 2026

Today’s threat intelligence covers active exploitation of Arista VeloCloud CVE-2026-16812, unauthenticated TeamCity RCE CVE-2026-63077, exposed IPMI/BMC password risks, and the Origin Energy and MCBS breach updates.

2026-07-29

Daily Global Cyber Threat Intelligence Digest — July 28, 2026

Today’s threat intelligence covers the Certighost CVE-2026-54121 AD CS domain-takeover chain, vBulletin CVE-2026-61511 pre-auth RCE, the expanding Dysphoria botnet, and the DentaQuest and Fairlife breach updates.

2026-07-28

Related Vulnerabilities

CVE-2026-659756.5

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but n...

CVE-2026-133064.3

Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to...

CVE-2025-65340

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php.

CVE-2026-61027.8

MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability. This vulnerability allows local attackers...