CVE-2025-32975Quest KACE SMA improper authentication, CISA KEV
What broke
Quest KACE SMA failed authentication (CWE-287). CISA added it to KEV. The exact exploit path is less important than the product class: a systems-management appliance that can push software and scripts to every endpoint.
Why it matters
KACE, N-able, PaperCut, and Ivanti keep landing on KEV for the same reason. They are identity-adjacent control planes with internet-facing logins. An auth bypass there is ransomware's favorite first step.
What to do
- Patch KACE now if it is reachable. If you do not need it on the internet, take it off.
- Hunt for new admin users and unexpected script deployments around the KEV date.
- Put appliance admin behind phishing-resistant MFA and a jump host.
After you patch
Remote management and support platforms are standing administrative access to every endpoint beneath them, which turns a single bypass into a many-customer incident.
- Revoke sessions and rotate the platform's own credentials, including agent enrolment keys.
- Review remote session logs for connections you cannot attribute to a technician.
- Look for independent egress the attacker may have added, such as new tunnel services or remote access tools on managed endpoints, because removing them from the console does not remove them from the network.
- Treat the platform as tier-zero privileged access in your access model going forward, not as IT tooling.
Sources
- NVD: CVE-2025-32975
- CISA Known Exploited Vulnerabilities catalog
Related identity CVEs
Related on Start with Identity
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.
- CVEConnectWise ScreenConnect auth bypass via an alternate path
ScreenConnect 23.9.7 and earlier skipped authentication on an alternate setup path (CWE-288). Attackers created admin users within hours. CISA KEV. CVSS 10.0. P
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a