Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 20/04/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| kace systems management appliance | ≥ 13.0, < 13.0.385≥ 13.1, < 13.1.81≥ 13.2, < 13.2.183≥ 14.0, < 14.0.341≥ 14.1, < 14.1.101 | 13.0.38513.1.8113.2.18314.0.34114.1.101 |
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free