Quest KACE SMA Flaw CVE-2025-32975: When One Unpatched Tool Opens the Door to 60 Organizations

Key Takeaways

• CVE-2025-32975 grants unauthenticated admin access via SSO bypass
• Patch released May 2025; 10 months of unpatched exposure
• Over 12,000 internet‑exposed KACE appliances remain vulnerable
• Attack on MSP revealed data of 60+ downstream clients
• Sophisticated toolkit exfiltrated 512 MB database dump of client records

Pulse Analysis

The Quest KACE Systems Management Appliance is a cornerstone for on‑premise endpoint control, handling software deployment, patch distribution, and device governance. CVE‑2025‑32975 exploits a flaw in the SSO authentication flow, allowing any network‑reachable actor to bypass credentials and assume administrative privileges. With a perfect CVSS score of 10.0, the vulnerability is among the most severe ever recorded for enterprise management platforms, and the vendor’s May 2025 fix was the first line of defense against a threat that could compromise every managed device.

In practice, the flaw proved catastrophic when attackers targeted HIQ, a managed‑services provider serving dozens of public‑sector and private clients. By exploiting an unpatched KACE appliance, they harvested a 512 MB MariaDB dump containing staff accounts, client lists, and help‑desk tickets for more than 60 organizations, ranging from law‑enforcement agencies to hospitals. The attackers left a 308 MB toolkit on an unsecured HTTP server, exposing the full intrusion chain—from reverse shells to a custom SOCKS5 tunnel—providing a rare glimpse into a sophisticated post‑exploitation operation. This breach illustrates how a single vulnerable vendor appliance can cascade into a multi‑industry supply‑chain incident.

The broader lesson for security leaders is clear: critical management tools must be inventoried, continuously monitored, and patched without delay. With over 12,000 KACE devices still broadcasting version strings that predate the fix, organizations should prioritize network segmentation, enforce strict access controls, and deploy external scanning to detect exposed appliances. Leveraging threat‑intel feeds for IoCs and applying the May 2025 patch are immediate steps, while longer‑term strategies should include automated patch management and zero‑trust principles to mitigate similar high‑severity risks in the future.