Arctic Wolf observed activity tied to exploitation of CVE-2025-32975 that allows unauthenticated attackers to impersonate users and potentially gain full administrative control of internet-exposed Quest KACE SMA appliances. Organizations still running unpatched KACE SMA instances are urged to apply the May 2025 patches immediately to prevent intrusions. #CVE-2025-32975 #QuestKACE
Keypoints
- Arctic Wolf detected suspicious activity linked to exploitation of CVE-2025-32975 against internet-exposed Quest KACE SMA appliances.
- CVE-2025-32975 enables unauthenticated attackers to impersonate legitimate users and may lead to full administrative takeover.
- Attackers appear to have used this vulnerability to gain initial access and achieve administrative control of affected systems.
- Arctic Wolf found no signs that CVE-2025-32976, CVE-2025-32977, or CVE-2025-32978 were involved in the observed incidents.
- Organizations using outdated KACE SMA versions should apply the May 2025 patches immediately to mitigate opportunistic exploitation.
Read More: https://www.securityweek.com/critical-quest-kace-vulnerability-potentially-exploited-in-attacks/