A critical security vulnerability, identified as CVE-2025-32975, has a CVSS score of 10.0 and is currently being exploited by threat actors targeting the Quest KACE Systems Management Appliance (SMA). Malicious activities linked to this flaw were first observed by Arctic Wolf starting the week of March 9, 2026, indicating a significant risk for unpatched systems connected to the internet.
The vulnerability allows attackers to bypass authentication, potentially enabling them to impersonate legitimate users and take full control of administrative accounts. Following the exploitation of this flaw, attackers have been reported to create unauthorized administrative accounts and execute remote commands to transfer malicious payloads from an external source.
To mitigate the risk, administrators are urged to install the most recent updates and ensure that SMA systems are not publicly accessible. The security issue was addressed in several updates, including versions 13.0.385, 13.1.81, and 14.1.101, among others.