CVE-2025-32975: Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

Added to the CISA Known Exploited Vulnerabilities catalog on 20 Apr 2026. Vendor: Quest. Product: KACE Systems Management Appliance (SMA).

Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due 04 May 2026)