Quest KACE Systems Management Appliance Authentication Bypass (CVE-2025-32975) | MSSP Advisory

CISA added CVE-2025-32975 to the Known Exploited Vulnerabilities catalog, targeting Quest KACE Systems Management Appliances with an authentication bypass that allows attackers to impersonate legitimate users without credentials. Government agencies have until May 2026 to patch or discontinue use, signaling active exploitation is already happening.

Your RMM and client management infrastructure becomes a direct target since Quest KACE appliances manage endpoints across multiple client networks, and authentication bypass means attackers can masquerade as legitimate administrators. Client contracts likely require you to alert them about threats affecting their managed infrastructure, making this both a technical emergency and a compliance obligation.