Critical Quest KACE SMA Vulnerability Exploited in Active Attacks Security researchers have uncovered active exploitation of a severe authentication bypass flaw in Quest KACE Systems Management Appliance (SMA), tracked as CVE-2025-32975, allowing attackers to gain full administrative control over vulnerable systems. The vulnerability affects the appliance’s Single Sign-On (SSO) mechanism, enabling threat actors to impersonate legitimate users without credentials. Quest KACE SMA is widely deployed for endpoint management, including software deployment, patching, and device monitoring, making it a prime target due to its deep integration into enterprise networks. Despite a patch being released in May 2025, many organizations remain unprotected, with exploitation activity first observed the week of March 9, 2026. Attackers exploit the flaw to bypass authentication, then use the KPluginRunProcess feature to execute remote commands via Base64-encoded payloads. In documented cases, they leveraged curl commands to fetch additional malware from a command-and-control server (216.126.225.156). Persistence is established by abusing runkbot.exe to create rogue administrative accounts and deploying PowerShell scripts (e.g., Enable-UpdateServices.ps1, taskband.ps1) to modify registry settings and maintain access across reboots. Once inside, attackers harvest credentials using Mimikatz (disguised as asd.exe) and conduct lateral movement via RDP, targeting domain controllers and backup systems (including Veeam and Veritas). This escalation increases risks of data theft, ransomware, or full network compromise. Affected versions include 13.0, 13.1, and 13.2, with fixes available in 13.0.385, 13.1.81, and 13.2.183 or later. Newer deployments (14.0, 14.1) require Patch 5 (14.0.341) and Patch 4 (14.1.101), respectively. Researchers also recommend removing KACE SMA from public internet exposure and restricting access via VPNs or secure network boundaries to mitigate risks. The campaign underscores the dangers of unpatched systems and the rapid weaponization of known vulnerabilities.