Back Securityaffairs.Co

Quest KACE SMA flaw CVE-2025-32975: when one unpatched tool opens the door to 60 organizations

Securityaffairs.Co •Pierluigi Paganini • May 13, 2026

CVE-2025-32975 is a critical flaw in Quest KACE SMA used for endpoint management. If exploited, it could impact all managed systems across organizations. CVE-2025-32975 is a critical flaw in Quest KACE SMA used for endpoint management. If exploited, it could impact all managed systems across organizations. Quest KACE SMA is an on-premises endpoint management platform […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2025-32975 Flaw in Quest KACE SMA Exploited, Affecting 60 Organizations The CVE-2025-32975 vulnerability in Quest KACE SMA, an endpoint management platform, has been exploited after remaining unpatched for 10 months. This severe authentication bypass flaw, with a CVSS score of 10.0, allows attackers to impersonate users without credentials. The incident primarily affected HIQ, a managed services provider, leading to the exfiltration of a 512 MB database containing sensitive information from over 60 organizations, including law enforcement and healthcare. Attackers utilized a sophisticated toolkit for reverse shells, command and control, and credential spraying. The vulnerability was published on June 24, 2025, and was added to CISA's KEV list for active exploitation on April 20, 2026. Over 12,000 internet-facing KACE 1000 appliances are potentially vulnerable due to outdated versions. The incident emphasizes the risks of unpatched vendor software in supply chains. 2 sources 75

Extracted Entities

CVEs (1)

CVE-2025-32975

Platforms (1)

Quest KACE SMA