CVE-2025-32975 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-06-24

Added to CISA KEV: 2026-04-20 300 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately patch to fixed versions: 13.0.385+, 13.1.81+, 13.2.183+, 14.0.341 (Patch 5)+, or 14.1.101 (Patch 4)+
If patching cannot be done immediately, remove KACE SMA from internet exposure and require VPN access
Review authentication logs for suspicious SSO authentication attempts
Monitor for unauthorized administrative activities and configuration changes
Patch priority: EMERGENCY - Apply within 24 hours due to active exploitation

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2025-32975 is a critical authentication bypass vulnerability affecting the Quest KACE Systems Management Appliance (SMA) ^[4] ^[2]. With a CVSS score of 10.0, it represents a severe security risk that allows for the complete compromise of affected systems ^[1] ^[3].

Key Details of CVE-2025-32975

Feature	Description
Vulnerability Type	Authentication Bypass (SSO handling mechanism) ^[5]
CVSS Score	10.0 (Critical) ^[1]
Exploitation	Active in the wild (observed since March 2026) ^[1]
Requirements	Network-reachable; no credentials or user interaction required ^[3]
Impact	Complete administrative takeover ^[5]

Exploitation and Threat Actor Usage

Active Exploitation: While the vulnerability was disclosed in June 2025, security researchers and firms (such as Arctic Wolf) observed active exploitation of unpatched systems beginning in March 2026 ^[1] ^[5].
Attack Method: The flaw exists within the Single Sign-On (SSO) authentication handling mechanism ^[2]. Attackers can exploit this remotely over the network to impersonate any user, including administrators, without needing valid credentials ^[3].
Impact: Successful exploitation grants the attacker full administrative control over the KACE SMA appliance, which can be used to deliver malicious payloads or further compromise the environment ^[1] ^[5].

Affected Versions and Mitigation

Quest released patches for this vulnerability in May 2025 ^[1]. Affected versions include:

13.0.x: Versions before 13.0.385 ^[4]
13.1.x: Versions before 13.1.81 ^[4]
14.0.x: Versions before 14.0.341 (Patch 5)?id=CVE-2025-32975?kagi_q=CVE-2025-32975
14.1.x: Versions before 14.1.101 (Patch 4)?id=CVE-2025-32975?kagi_q=CVE-2025-32975

Organizations using these products should ensure they have applied the latest available patches from Quest to mitigate the risk of administrative takeover ^[2].

Sources

Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest ...
CVE-2025-32975 (CVSS score: 10.0) refers to an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. Successful exploitation of the flaw could facilitate the complete takeover of administrative accounts. The issue was patched by Quest in…
CVE-2025-32975: Quest KACE SMA Auth Bypass Vulnerability
CVE-2025-32975 Overview CVE-2025-32975 is a critical authentication bypass vulnerability affecting Quest KACE Systems Management Appliance (SMA). The vulnerability exists in the SSO authentication handling mechanism and allows attackers to impersonate legitimate users without valid credentials, pote…
CVE-2025-32975: The Open Directory Behind the KACE SMA Breach and 60 ...
CVE-2025-32975 is a critical authentication bypass vulnerability in KACE SMA's SSO authentication handling mechanism with a CVSS score of 10.0. The flaw allows an unauthenticated, network-reachable attacker to impersonate legitimate users, including administrators, without supplying any credentials.
CVE-2025-32975 Details - NVD
CVE-2025-32975 Detail. Description. Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81 ... An official website of the United States government NVD MENU…
CVE-2025-32975: Arctic Wolf Observes ...
CVE-2025-32975: Arctic Wolf Observes Exploitation of Quest KACE Systems Management Appliance. Arctic Wolf has observed malicious activity in ... CVE-2025-32975 is a critical authentication bypass vulnerability that allows threat actors to impersonate legitimate users without valid credentials. The f…