# Quest KACE SMA Critical Authentication Bypass Actively Exploited in Education Sector (CVE-2025-32975)

> CVE-2025-32975 is a CVSS 10.0 authentication bypass in Quest KACE Systems Management Appliance (SMA) SSO handling that allows unauthenticated attackers to impersonate any user and gain full administrative control. Arctic Wolf observed active exploitation starting March 9, 2026 against education sector organizations, with attackers leveraging KPluginRunProcess for remote code execution, deploying Mimikatz for credential harvesting, and establishing C2 communications.

- **Published:** 2026-03-21T12:00:00Z
- **Last reviewed:** 2026-03-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0267
- **ID:** TL-2026-0267
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-32975, CVE-2025-32976, CVE-2025-32977, CVE-2025-32978

## Description

Quest KACE Systems Management Appliance (SMA) contains a critical authentication bypass vulnerability (CVE-2025-32975) in its Single Sign-On (SSO) authentication handling mechanism. The flaw allows unauthenticated remote attackers to impersonate any legitimate user — including administrators — without providing valid credentials. Successful exploitation grants complete administrative control over the KACE SMA appliance.

KACE SMA is an on-premises endpoint management platform widely deployed in education, healthcare, and government sectors for centralized asset inventory, software deployment, patching, and endpoint monitoring. Compromise of a KACE SMA instance is particularly impactful because the appliance manages and has privileged access to all enrolled endpoints across the organization, enabling rapid lateral movement and full network takeover.

The vulnerability was discovered by Philippe Caturegli and Mohamed Mahmoudi of Seralys during a third-party security review and responsibly disclosed to Quest Software on April 14, 2025. Quest released hotfixes on May 27, 2025, and Seralys published a high-level advisory on June 23, 2025. Detailed technical exploitation methodology and proof-of-concept code remain embargoed.

Three additional vulnerabilities were disclosed alongside CVE-2025-32975: CVE-2025-32976 (CVSS 8.8, 2FA bypass via TOTP validation flaw), CVE-2025-32977 (CVSS 9.6, unauthenticated backup file upload with weak signature validation), and CVE-2025-32978 (CVSS 7.5, unauthenticated license replacement causing DoS). All four are patched in the same hotfix releases.

Starting the week of March 9, 2026, Arctic Wolf's threat intelligence team observed active exploitation of CVE-2025-32975 against unpatched KACE SMA instances exposed to the internet. The observed attack chain proceeds as follows:

1. Initial Access: Attackers exploit CVE-2025-32975 to bypass SSO authentication and gain administrative access to the KACE SMA web interface without credentials.

2. Execution: Attackers abuse the legitimate KPluginRunProcess functionality within KACE SMA to execute arbitrary remote commands on the appliance. Analysis of KACE logs revealed Base64-encoded command payloads.

3. Command and Control: Attackers use curl to download files from the C2 server at 216.126.225.156, establishing persistent command-and-control communication channels.

4. Persistence: Attackers create additional administrative accounts via runkbot.exe (a legitimate Quest KACE process) and attempt to add these accounts to local and domain administrative groups.

5. Credential Access: Credential harvesting is performed using Mimikatz, with at least one instance observed where Mimikatz was disguised as asd.exe to evade detection.

The attacks primarily targeted education sector organizations. Arctic Wolf has not attributed the activity to a specific threat actor or nation-state, and stated they are unable to provide additional details regarding attacker identity or motivation at this time.

Organizations running KACE SMA should apply patches immediately (versions 13.0.385, 13.1.81, 13.2.183, 14.0.341 Patch 5, or 14.1.101 Patch 4). KACE SMA instances should never be directly exposed to the public internet; remote access should be restricted through VPN or firewall rules.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1569 System Services
- T1136 Create Account
- T1098 Account Manipulation
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1087 Account Discovery
- T1082 System Information Discovery
- T1021 Remote Services
- T1210 Exploitation of Remote Services
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1531 Account Access Removal

## Sources

- [Arctic Wolf - CVE-2025-32975 Exploitation Observed](https://arcticwolf.com/resources/blog/cve-2025-32975/)
- [Arctic Wolf UK - CVE-2025-32975 Exploitation Advisory](https://arcticwolf.com/resources/blog-uk/cve-2025-32975-arctic-wolf-observes-exploitation-of-quest-kace-systems-management-appliance/)
- [SecurityWeek - Critical Quest KACE Vulnerability Exploited in Attacks](https://www.securityweek.com/critical-quest-kace-vulnerability-potentially-exploited-in-attacks/)
- [SecurityOnline - Critical Quest KACE Flaw Exploited for Network Takeover](https://securityonline.info/critical-quest-kace-flaw-exploited-network-takeover-cve-2025-32975/)
- [Quest KB-4379499 - KACE SMA Vulnerability Response](https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978)
- [KACE Changelog - SMA CVE Resolution](https://changelog.kace.com/posts/2025/2025-06-10-sma-cve/)
- [Seralys Research - CVE-2025-32975 Full Disclosure](https://seralys.com/research/CVE-2025-32975.txt)
- [Full Disclosure Mailing List - CVE-2025-32975](https://seclists.org/fulldisclosure/2025/Jun/22)
- [NVD - CVE-2025-32975](https://nvd.nist.gov/vuln/detail/CVE-2025-32975)
- [Belgium CCB Advisory - Quest KACE SMA Vulnerabilities](https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-found-quest-kace-systems-management-appliance-patch)
- [SentinelOne - CVE-2025-32975 Vulnerability Database Entry](https://www.sentinelone.com/vulnerability-database/cve-2025-32975/)
- [News4Hackers - KACE Critical Vulnerability Exploited](https://www.news4hackers.com/kace-critical-vulnerability-exploited-in-cyber-attacks-what-you-need-to-know)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0267