CVE-2021-32086

Analyzed Analyzed - Analysis Complete

Hard-Coded Encryption Key in Quest KACE SMA

Publication date: 2026-07-27

Last updated on: 2026-08-03

Assigner: MITRE

Description

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain privileged access to unrelated systems or services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-08-03

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2021-32086

EUVD

EUVD-2021-34856

Affected Vendors & Products

Vendor	Product	Version / Range
quest	kace_systems_management_appliance	11.0.273

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability involves Quest KACE Systems Deployment Appliance (SMA) 11.0.273 using a hardcoded symmetric encryption key to encrypt secrets in its MySQL databases. The key is not unique per installation, meaning all systems share the same key. If an attacker gains access to the MySQL server or backup files, they can decrypt these secrets.

Detection Guidance

This vulnerability involves hardcoded encryption keys in Quest KACE SMA 11.0.273. Detection requires checking for exposed MySQL databases or backup files containing encrypted secrets. Inspect database backups or MySQL server access logs for unauthorized decryption attempts. No specific commands are provided in the context.

Impact Analysis

An attacker exploiting this vulnerability could decrypt sensitive secrets stored in the database. These secrets might allow privilege escalation within KACE or provide access to unrelated systems or services that rely on the same credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations due to potential data breaches resulting from decrypted secrets.

Mitigation Strategies

Rotate the hardcoded symmetric encryption key used in the MySQL databases for Quest KACE SMA. Ensure the new key is unique per installation. Restrict access to MySQL server and backup files to authorized personnel only.

Hi! I’m here to help you understand CVE-2021-32086. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70