Threat Intelligence / CVE / CVE-2025-32978

CVE-2025-32978

CVSS 7.5 (HIGH) · EPSS 0.2% · Priority 5.4/10 · Published 2025-06-24

As of 2025-11-03, CVE-2025-32978 is a CVSS 7.5 (HIGH-severity) vulnerability. EPSS exploitation probability 0.2%. Threadlinqs Intelligence tracks 1 threat exploiting it.

Last updated: 2025-11-03

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to replace system licenses through a web interface intended for license renewal. Attackers can exploit this to replace valid licenses with expired or trial licenses, causing denial of service.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-306

Threats tracking this CVE

Quest KACE SMA Critical Authentication Bypass Actively Exploited in Education Sector (CVE-2025-32975) — CRITICAL

References

Full detection coverage & IOCs for threats exploiting CVE-2025-32978 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.