CVE-2025-32975: Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.
Overview
Quest KACE Systems Management Appliance contains an authentication bypass in its SSO handling mechanism that allows a remote attacker to impersonate any valid user, including administrators, without supplying credentials. Successful exploitation gives the attacker complete administrative control over the appliance. Versions across the 13.0, 13.1, 13.2, 14.0, and 14.1 release lines are affected; fixed builds are available for each.
Vulnerability details
The flaw is classified as CWE-287 (Improper Authentication), meaning the appliance fails to verify that the entity claiming an identity is actually who it claims to be. In KACE SMA, this failure occurs specifically in the SSO authentication handling mechanism. When a user authenticates via SSO, the appliance processes an authentication assertion or token and decides whether to grant access. The defect allows that decision to be made incorrectly: the appliance accepts a crafted or manipulated authentication submission as valid even though no legitimate credential backs it, granting a session at whatever privilege level the impersonated account holds.
An attacker who can reach the KACE SMA management interface over the network sends a crafted SSO authentication request that claims to be a known valid username on the appliance. No password or other credential is required. The appliance accepts the forged material and grants full administrative access, resulting in complete takeover of the endpoint management platform. The only precondition beyond network reachability is knowledge of a valid username to impersonate. The exact format of the manipulated SSO material has not been publicly disclosed; the researchers who discovered the flaw have withheld proof-of-concept details pending the standard 90-day disclosure period.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review KACE SMA authentication logs for admin-level sessions that originated via SSO but have no corresponding identity-provider event or where the SSO assertion timestamp, issuer, or signature fields are absent or malformed.
- Look for administrative actions (policy changes, script deployments, agent configuration edits) performed by accounts that have no recent interactive login in the identity provider's own audit trail, indicating a session that bypassed normal credential flow.
- Monitor for unexpected administrative account activity from source IP addresses outside the organization's known management subnets, particularly where the session was established without a preceding MFA or IdP authentication event.
Remediation
Additional hardening
- Upgrade KACE SMA to 13.0.385, 13.1.81, or 13.2.183 for 13.x deployments, or to 14.0.341 (Patch 5) or 14.1.101 (Patch 4) for 14.x deployments; see the vendor advisory in References for patch delivery instructions.
- Restrict network access to the KACE SMA management interface to trusted administrative subnets only, using firewall rules or network segmentation to prevent unauthenticated internet-facing exposure of the SSO endpoint.
- Audit all administrative accounts on the appliance for unexpected sessions, configuration changes, or newly created accounts that may indicate exploitation prior to patching, and rotate credentials for any accounts that could have been impersonated.
- If immediate patching is not possible and the appliance cannot be isolated, consider disabling SSO authentication and requiring direct local credential authentication until the fixed build can be applied.
Key dates
References
- https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978
- https://nvd.nist.gov/vuln/detail/CVE-2025-32975
- https://seclists.org/fulldisclosure/2025/Jun/22
- https://seralys.com/research/CVE-2025-32975.txt
- http://seclists.org/fulldisclosure/2025/Jun/25
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32975
Frequently asked questions
Does CVE-2025-32975 affect my FedRAMP authorization?
If Quest KACE Systems Management Appliance (SMA) runs inside your authorization boundary, yes. CVE-2025-32975 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of May 4, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your options are to remediate it immediately or formally document the mitigation and the delay.
How does Knox help me handle CVE-2025-32975?
Knox does not patch your software. Remediating Quest KACE Systems Management Appliance (SMA) is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage that support your documentation for the next assessment. Applying the fix is yours to do; maintaining a defensible compliance posture while you do it is not something you have to manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis, including cases like CVE-2025-32975. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at a scheduled review, giving you time to act before a finding becomes a formal conversation.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2025-32975's remediation deadline of May 4, 2026 has passed. What happens now?
If CVE-2025-32975 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing out the vulnerability now and documenting why the deadline was missed is what keeps your authorization standing and the agency relationship intact.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
