CVE-2025-32975 – Critical SSO Authentication Bypass in Quest KACE Systems Management Appliance

Key Takeaways

Severity: Critical (CVSS 10.0)

Impact: Unauthenticated attackers can bypass SSO and obtain full administrative control of Quest KACE SMA.

Who is at risk: Any organization running an unpatched Quest KACE Systems Management Appliance.

Immediate action: Deploy the vendor patch or isolate the appliance; monitor for exploitation indicators.

Overview

On March 2026, security researchers from Arctic Wolf reported that CVE-2025-32975 is being actively exploited in the wild. The vulnerability resides in the SSO authentication flow of the Quest KACE Systems Management Appliance (SMA), a widely deployed endpoint‑management solution. Exploitation enables a remote, unauthenticated adversary to bypass authentication and assume full admin privileges, effectively taking over the appliance and any network segments it controls.

Threat‑intelligence feeds recorded 75 mentions over a six‑day window (2026‑03‑19 to 2026‑03‑24). The most intense activity occurred on 2026‑03‑23, with 49 active‑exploitation signals and 2 exploit‑tool indicators reported.

Technical Details

The flaw is an authentication bypass in the SSO login mechanism. Crafted SSO tokens are accepted without proper signature verification, allowing the creation of a privileged session. The issue aligns with CWE-287 (Improper Authentication).

A simplified example of an exploit request:

GET /sso/login?token=malicious_token HTTP/1.1
Host: kace-appliance.example.com

When the appliance processes the request, it grants an admin session to the attacker. From there, the adversary can execute arbitrary commands, install malicious payloads, or pivot to other systems.

Severity & Impact

CVSS: CVSS 10.0 (Critical)
Impact: Full administrative takeover, arbitrary command execution, data exfiltration, and potential ransomware deployment.
Exploitability: Confirmed active exploitation with publicly observed exploit tools and proof‑of‑concept code.

Affected Products

Quest KACE Systems Management Appliance (SMA) – all versions prior to the March 2026 security update.
For the exhaustive list of affected versions, see the official CVE entry: https://vulnsocial.com/cve/CVE-2025-32975.

What to Do (Actionable Insights)

Patch immediately: Apply the vendor patch as soon as it is released.
Isolate the appliance: Block inbound traffic from untrusted networks and place the SMA on a dedicated management VLAN.
Disable SSO temporarily: If a patch cannot be applied quickly, turn off SSO authentication and enforce multi‑factor authentication for local admin accounts.
Monitor logs: Look for anomalous SSO token usage, new admin sessions, or login attempts from unexpected IP ranges.
Run vulnerability scans: Ensure your scanners are updated to detect CVE-2025-32975.
Leverage threat intel: Subscribe to feeds that flag the exploit‑tool signatures observed on 2026‑03‑23.

Remediation & Mitigation (Step‑by‑Step)

Identify the SMA version:

# On the appliance console
kace --version

Download the official patch from the Quest security advisory portal.
Backup configuration and database before applying the update.
Install the update following Quest’s instructions; reboot if required.
Verify the patch: re‑run the version command and confirm the vulnerability is no longer reported.
Enforce strong, unique admin credentials and enable MFA for any remote access.
Restrict network access: allow only management IP ranges to communicate with the SMA.
Audit for newly created admin accounts or unexpected changes to system settings.

Bottom Line

CVE-2025-32975 is a Critical SSO authentication bypass in Quest KACE Systems Management Appliance with a CVSS 10.0 rating. Confirmed active exploitation makes rapid patch deployment or isolation essential, followed by continuous monitoring for compromise indicators.

References

#CVE #CVE202532975 #Critical #QuestKACE #SSO #AuthenticationBypass #Exploit #Patch #ArcticWolf