# CVE-2025-32975: Quest KACE SMA SSO Authentication Bypass Enables Admin Takeover — Actively Exploited

> Critical authentication bypass vulnerability (CVSS 10.0) in Quest KACE Systems Management Appliance (SMA) SSO mechanism allows unauthenticated remote attackers to impersonate legitimate users and achieve full administrative takeover. Actively exploited in the wild since March 2026 with post-exploitation credential theft and lateral movement to domain controllers.

- **Published:** 2026-03-23T12:00:00Z
- **Last reviewed:** 2026-03-23T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0272
- **ID:** TL-2026-0272
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-32975

## Description

CVE-2025-32975 is a critical improper authentication vulnerability (CWE-287) in the Single Sign-On (SSO) authentication handler of Quest KACE Systems Management Appliance (SMA). The flaw allows unauthenticated attackers to bypass SSO authentication entirely and impersonate any legitimate user — including administrators — without valid credentials, passwords, or authentication tokens.

The vulnerability carries the maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting its network-accessible attack vector, low complexity, zero privilege/interaction requirements, and changed scope with full confidentiality, integrity, and availability impact. Successful exploitation grants complete administrative control over the KACE SMA appliance, which serves as centralized endpoint management infrastructure across enterprise environments.

The vulnerability was responsibly disclosed by security researchers Philippe Caturegli and Mohamed Mahmoudi of Seralys Research Team on April 14, 2025. Quest Software developed and validated a hotfix between May 8-17, 2025, with public hotfix release on May 27, 2025. High-level disclosure was published on June 23, 2025. The NVD published the entry on June 24, 2025.

Despite patches being available since May 2025, Arctic Wolf began observing active exploitation of unpatched, internet-exposed KACE SMA instances starting the week of March 9, 2026. The observed attack chain involves: (1) authentication bypass via CVE-2025-32975 on internet-facing SMA instances, (2) seizure of administrative account control, (3) abuse of KPluginRunProcess functionality to execute remote commands, (4) downloading Base64-encoded payloads from the external server 216.126.225.156 via curl, (5) creation of additional administrative accounts using runkbot.exe (the KACE SMA Agent background process), (6) Windows Registry modifications for persistence, (7) deployment of Mimikatz (disguised as asd.exe) for credential harvesting from LSASS memory, (8) reconnaissance via net time, net group, and administrator/user enumeration commands, and (9) lateral movement via RDP to backup infrastructure (Veeam, Veritas) and Active Directory domain controllers.

Quest KACE SMA is widely deployed across enterprises for systems management, software distribution, patching, and asset inventory. Compromise of KACE SMA infrastructure provides attackers with a privileged position to pivot across the entire managed endpoint fleet, access credential stores, and compromise backup and domain controller infrastructure. The targeting of backup systems (Veeam, Veritas) is consistent with pre-ransomware operational patterns.

Affected versions span the 13.x and 14.x branches: 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4). Note that upgrades from 14.0.341 to 14.1.95 are not supported — administrators must install 14.1.101 directly. Additionally, the 13.x security hotfix must be re-applied after every full 13.x upgrade. A known issue exists where KACE Go app users cannot login after applying the security patch.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1136 Create Account
- T1059 Command and Scripting Interpreter
- T1003 OS Credential Dumping
- T1036 Masquerading
- T1112 Modify Registry
- T1087 Account Discovery
- T1124 System Time Discovery
- T1069 Permission Groups Discovery
- T1021 Remote Services
- T1105 Ingress Tool Transfer
- T1132 Data Encoding

## Sources

- [NVD - CVE-2025-32975](https://nvd.nist.gov/vuln/detail/CVE-2025-32975)
- [Quest Support KB4379499 - Official Patches](https://support.quest.com/kb/4379499/)
- [Seralys Research - CVE-2025-32975 Full Disclosure](https://seralys.com/research/CVE-2025-32975.txt)
- [Full Disclosure Mailing List - CVE-2025-32975](https://seclists.org/fulldisclosure/2025/Jun/22)
- [Arctic Wolf - CVE-2025-32975 Active Exploitation Observed](https://arcticwolf.com/resources/blog/cve-2025-32975/)
- [Arctic Wolf UK - Exploitation of Quest KACE SMA](https://arcticwolf.com/resources/blog-uk/cve-2025-32975-arctic-wolf-observes-exploitation-of-quest-kace-systems-management-appliance/)
- [The Hacker News - Hackers Exploit CVE-2025-32975 to Hijack Quest KACE SMA](https://thehackernews.com/2026/03/hackers-exploit-cve-2025-32975-cvss-100.html)
- [SOCRadar Analysis - Quest KACE SMA SSO Auth Bypass](https://socradar.io/blog/cve-2025-32975-quest-kace-sma-sso-auth-bypass/)
- [SecurityWeek - Critical Quest KACE Vulnerability Exploited in Attacks](https://www.securityweek.com/critical-quest-kace-vulnerability-potentially-exploited-in-attacks/)
- [Security Online - Critical Quest KACE Flaw Exploited for Network Takeover](https://securityonline.info/critical-quest-kace-flaw-exploited-network-takeover-cve-2025-32975/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0272