CVE-2025-32975: Quest KACE SMA SSO Authentication Bypass Enables Admin Takeover — Actively Exploited
CVE-2025-32975 (TL-2026-0272) is a critical-severity software vulnerability scored CVSS 10, first published 2026-03-23. It has no confirmed attribution, affects Quest Software KACE Systems Management Appliance (SMA), references 1 CVE (CVE-2025-32975), maps to 13 MITRE ATT&CK techniques (T1003, T1021, T1036), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0272
- Threat ID
- TL-2026-0272
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- 2026-03-23
- Last reviewed
- 2026-03-23
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- enterprise, government, education, healthcare, financial, technology, manufacturing
- Target regions
- North America, Europe, Asia-Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in CVE-2025-32975
Malware and tooling: Mimikatz
Critical authentication bypass vulnerability (CVSS 10.0) in Quest KACE Systems Management Appliance (SMA) SSO mechanism allows unauthenticated remote attackers to impersonate legitimate users and achieve full administrative takeover. Actively exploited in the wild since March 2026 with post-exploitation credential theft and lateral movement to domain controllers.
How CVE-2025-32975 works
CVE-2025-32975 is a critical improper authentication vulnerability (CWE-287) in the Single Sign-On (SSO) authentication handler of Quest KACE Systems Management Appliance (SMA). The flaw allows unauthenticated attackers to bypass SSO authentication entirely and impersonate any legitimate user — including administrators — without valid credentials, passwords, or authentication tokens.
The vulnerability carries the maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting its network-accessible attack vector, low complexity, zero privilege/interaction requirements, and changed scope with full confidentiality, integrity, and availability impact. Successful exploitation grants complete administrative control over the KACE SMA appliance, which serves as centralized endpoint management infrastructure across enterprise environments.
The vulnerability was responsibly disclosed by security researchers Philippe Caturegli and Mohamed Mahmoudi of Seralys Research Team on April 14, 2025. Quest Software developed and validated a hotfix between May 8-17, 2025, with public hotfix release on May 27, 2025. High-level disclosure was published on June 23, 2025. The NVD published the entry on June 24, 2025.
Despite patches being available since May 2025, Arctic Wolf began observing active exploitation of unpatched, internet-exposed KACE SMA instances starting the week of March 9, 2026. The observed attack chain involves: (1) authentication bypass via CVE-2025-32975 on internet-facing SMA instances, (2) seizure of administrative account control, (3) abuse of KPluginRunProcess functionality to execute remote commands, (4) downloading Base64-encoded payloads from the external server 216.126.225.156 via curl, (5) creation of additional administrative accounts using runkbot.exe (the KACE SMA Agent background process), (6) Windows Registry modifications for persistence, (7) deployment of Mimikatz (disguised as asd.exe) for credential harvesting from LSASS memory, (8) reconnaissance via net time, net group, and administrator/user enumeration commands, and (9) lateral movement via RDP to backup infrastructure (Veeam, Veritas) and Active Directory domain controllers.
Quest KACE SMA is widely deployed across enterprises for systems management, software distribution, patching, and asset inventory. Compromise of KACE SMA infrastructure provides attackers with a privileged position to pivot across the entire managed endpoint fleet, access credential stores, and compromise backup and domain controller infrastructure. The targeting of backup systems (Veeam, Veritas) is consistent with pre-ransomware operational patterns.
Affected versions span the 13.x and 14.x branches: 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4). Note that upgrades from 14.0.341 to 14.1.95 are not supported — administrators must install 14.1.101 directly. Additionally, the 13.x security hotfix must be re-applied after every full 13.x upgrade. A known issue exists where KACE Go app users cannot login after applying the security patch.
MITRE ATT&CK techniques used in TL-2026-0272
credential-access
lateral-movement
defense-evasion
T1036 Masquerading; T1078 Valid Accounts
execution
T1059 Command and Scripting Interpreter
discovery
T1069 Permission Groups Discovery; T1087 Account Discovery; T1124 System Time Discovery
command-and-control
T1105 Ingress Tool Transfer; T1132 Data Encoding
defense-impairment
persistence
initial-access
Affected products and versions in CVE-2025-32975
- Quest Software — KACE Systems Management Appliance (SMA)
Vulnerable versions: 13.0.x before 13.0.385; 13.1.x before 13.1.81; 13.2.x before 13.2.183; 14.0.x before 14.0.341; 14.1.x before 14.1.101
Fixed in: 13.0.385; 13.1.81; 13.2.183; 14.0.341 (Patch 5); 14.1.101 (Patch 4)
Remediation for CVE-2025-32975
Patches
- KACE SMA 13.0.385 (security hotfix — must be re-applied after each 13.x upgrade)
- KACE SMA 13.1.81 (security hotfix — must be re-applied after each 13.x upgrade)
- KACE SMA 13.2.183 (security hotfix — must be re-applied after each 13.x upgrade)
- KACE SMA 14.0.341 (Patch 5)
- KACE SMA 14.1.101 (Patch 4) — direct install required, upgrade from 14.0.341 to 14.1.95 not supported
Immediate actions
- Isolate all unpatched Quest KACE SMA instances from the internet immediately
- Block inbound/outbound traffic to 216.126.225.156 at network perimeter
- Audit all KACE SMA administrative accounts for unauthorized additions
- Review KACE SMA logs for KPluginRunProcess and runkbot.exe abuse
- Scan for Mimikatz artifacts (including files named asd.exe) on managed endpoints
- Force password reset for all accounts with KACE SMA administrative access
- Check for unauthorized RDP sessions to backup and domain controller systems
Workarounds
- Restrict KACE SMA network access to internal management VLAN only
- Disable SSO authentication and use local authentication until patching is complete
- Place KACE SMA behind a reverse proxy with additional authentication layer
- Block curl and PowerShell execution from KACE SMA process context where possible
Longer-term hardening
- Never expose KACE SMA directly to the internet — mandate VPN or ZTNA for remote administration
- Deploy EDR with behavioral detection for credential dumping and lateral movement
- Implement network segmentation isolating management appliances from production networks
- Enable multi-factor authentication for all administrative access to KACE SMA
- Monitor for anomalous runkbot.exe process execution patterns
- Establish automated patch management workflow for KACE SMA security updates
CVEs associated with CVE-2025-32975
Weaknesses (CWE) in CVE-2025-32975
CWE-287
Timeline of CVE-2025-32975
- Seralys researchers Philippe Caturegli and Mohamed Mahmoudi reported the vulnerability to Quest Software
- Quest Software shared preliminary hotfix for validation
- Hotfix validation completed by Seralys
- Quest publicly released security hotfix for all affected KACE SMA versions (13.0.385, 13.1.81, 13.2.183, 14.0.341 Patch 5, 14.1.101 Patch 4)
- Seralys published high-level disclosure advisory on Full Disclosure mailing list and research site (CVE-2025-32975)
- NVD published CVE-2025-32975 entry with CVSS 10.0 score from CISA-ADP
- NVD last modified date for CVE-2025-32975 record
- Arctic Wolf began observing active exploitation of unpatched, internet-exposed KACE SMA instances in customer environments
- Arctic Wolf published security bulletin documenting observed exploitation activity including credential theft via Mimikatz and lateral movement
- Widespread media coverage from The Hacker News, SecurityWeek, SOCRadar, and Security Online reporting active exploitation campaigns
- As of 2026-05-29, CVE-2025-32975 (Quest KACE SMA, CVSS 10.0) remains actively exploited: CISA added it to KEV on Apr 20 2026 (deadline May 4), and a May 13 Hunt.io/Security Affairs report tied a compromised MSP to 60+ victims with ~12,000 unpatched appliances still internet-facing. Patch is available since May 2025 and the actor stays unattributed, so it stays under active monitoring rather than resolved.
Sources cited for CVE-2025-32975
- NVD - CVE-2025-32975
- Quest Support KB4379499 - Official Patches
- Seralys Research - CVE-2025-32975 Full Disclosure
- Full Disclosure Mailing List - CVE-2025-32975
- Arctic Wolf - CVE-2025-32975 Active Exploitation Observed
- Arctic Wolf UK - Exploitation of Quest KACE SMA
- The Hacker News - Hackers Exploit CVE-2025-32975 to Hijack Quest KACE SMA
- SOCRadar Analysis - Quest KACE SMA SSO Auth Bypass
- SecurityWeek - Critical Quest KACE Vulnerability Exploited in Attacks
- Security Online - Critical Quest KACE Flaw Exploited for Network Takeover
Threats related to CVE-2025-32975
Detection coverage for TL-2026-0272
As of 2026-03-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0272 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.