Back Heise.De

Patch now! Attacks on Quest KACE Systems Management Appliance

Heise.De • March 24, 2026

Attackers are currently exploiting a “ critical ” security vulnerability in the Quest KACE Systems Management Appliance (SMA) endpoint management system, compromising publicly accessible instances. Security updates have been available for download since May of last year. Apparently, not all SMA admins have installed them yet.

Security researchers from Arctic Wolf are pointing out the attacks in a post . According to a warning from software manufacturer Quest, the “ critical ” vulnerability (CVE-2025-32975) with the highest possible CVSS score of 10 out of 10 affects SSO authentication .

Due to unspecified errors, attackers can bypass login and access systems as any legitimate user. They can then completely take over instances with administrative rights.

How attacks specifically proceed and what attackers do with compromised systems is currently unclear. It is also currently unknown to what extent the attacks are occurring. Admins should ensure that one of the secured SMA versions is installed. The patches also close further vulnerabilities (CVE-2025-32976, CVE-2025-32977, CVE-2025-32978), which, according to security researchers, are not relevant to the currently ongoing attacks.

In addition to installing the security updates, admins should not make the endpoint management system publicly accessible. If this is unavoidable, access must be secured via a VPN connection, for example. This applies not only to SMA but generally.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Exploitation of Quest KACE SMA Vulnerability Underway Active exploitation of a critical vulnerability (CVE-2025-32975) in the Quest KACE Systems Management Appliance (SMA) is occurring, with attackers targeting unpatched instances to bypass authentication and gain administrative access. The vulnerability, which has a CVSS score of 10, allows attackers to infiltrate corporate networks and harvest sensitive credentials. Security updates addressing this issue were made available in June 2025, but many administrators have yet to apply them. The attacks reportedly began around March 9, 2026, and while the full scope of the impact is still unclear, the potential for significant damage to corporate networks exists. Additional vulnerabilities (CVE-2025-32976, CVE-2025-32977, CVE-2025-32978) were also patched, though they are not currently being exploited. Administrators are advised to secure their systems and limit public access to the SMA. The situation remains critical as the threat actors continue their operations. 2 sources 78

Extracted Entities

Patch now! Attacks on Quest KACE Systems Management Appliance

The full story

Extracted Entities

Attack Types (1)

CVEs (4)

MITRE ATT&CK (2)