CVE-2025-32976
Awaiting Analysis Awaiting Analysis - Queue
BaseFortify

Publication date: 2025-06-24

Last updated on: 2025-11-03

Assigner: MITRE

Description
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains a logic flaw in its two-factor authentication implementation that allows authenticated users to bypass TOTP-based 2FA requirements. The vulnerability exists in the 2FA validation process and can be exploited to gain elevated access.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-06-24
Last Modified
2025-11-03
Generated
2026-05-07
AI Q&A
2025-06-24
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

CVE-2025-32976 is a high-severity logic flaw in the two-factor authentication (2FA) implementation of Quest KACE Systems Management Appliance (SMA). It allows authenticated users to bypass the Time-based One-Time Password (TOTP) 2FA requirement by exploiting a flaw in the 2FA validation process. This means that even if 2FA is enabled, an attacker who already has some level of access can circumvent the additional authentication step to gain elevated privileges. [1, 2]


How can this vulnerability impact me? :

This vulnerability can allow an attacker who has authenticated access to the Quest KACE SMA to bypass the TOTP-based 2FA protection and gain elevated administrative access. This elevated access can lead to unauthorized control over the appliance, potentially compromising confidentiality, integrity, and availability of the managed systems and data. [1, 2, 3]


What immediate steps should I take to mitigate this vulnerability?

To mitigate the CVE-2025-32976 vulnerability, immediately update your Quest KACE Systems Management Appliance (SMA) to one of the patched versions: 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5), or 14.1.101 (Patch 4). For 13.x versions, apply the security hotfix via the Admin console under Settings | Appliance Updates and reapply it after every full upgrade within the 13.x series. For versions 14.0 and later, apply the latest patches through the support portal or automatic updates via the Admin UI. Avoid unsupported upgrade paths such as from 14.0.341 directly to 14.1.95. If you experience login issues with the KACE Go app after patching, follow the guidance provided by Quest support. [1, 2, 3]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart