Critical Vulnerability CVE-2025-32975 Exploited by Hackers to Compromise KACE SMA Systems

Introduction

In a significant cybersecurity threat, hackers have been actively exploiting a severe vulnerability known as CVE-2025-32975. Classified with a CVSS score of 10.0, this vulnerability allows for an authentication bypass in the Quest KACE Systems Management Appliance (SMA). The exploitation of this flaw has been detected on unpatched systems that are exposed to the internet since March 9, 2026, as revealed by security experts at Arctic Wolf.

Details of the Exploit

The vulnerability in question, CVE-2025-32975, presents a critical risk for organizations using KACE SMA, which is often employed for systems management and device inventory. Attackers leveraging this flaw can gain full administrative access to the affected systems, allowing them to execute a range of malicious activities.

How Attackers Operate

Once access is gained, the attackers employ various tactics to further entrench themselves within the compromised systems:

• Payload Delivery: Attackers drop Base64-encoded payloads from the IP address 216.126.225.156 using the curl command.
• Account Creation: They create new administrative accounts utilizing a file named runkbot.exe.
• Registry Modification: The Windows Registry is modified through PowerShell commands, enabling persistent access.
• Credential Harvesting: Tools such as Mimikatz are employed to harvest sensitive credentials from the compromised systems.
• Reconnaissance: Attackers conduct reconnaissance using net commands to map the network and discover further targets.
• Remote Access: Access to Remote Desktop Protocol (RDP) services on Veeam, Veritas backups, and domain controllers is also achieved, allowing for extensive control over the network.

Patch History and Response

Quest, the vendor behind KACE SMA, patched CVE-2025-32975 in May 2025. Unfortunately, many organizations remain vulnerable as they have not applied the necessary updates. This oversight has enabled cybercriminals to exploit the vulnerability effectively.

Impact of the Exploit

The implications of this exploit are severe. Organizations that fail to secure their KACE SMA systems leave themselves open to administrative hijacking, which can lead to:

• Data breaches involving sensitive information
• Disruption of critical business operations
• Potential ransomware attacks
• Loss of customer trust and reputational damage

Given the nature of the operations that can be performed once an attacker gains access, the potential for long-term damage is significant.

Recommendations for Organizations

In light of this exploit, it is imperative for organizations to take immediate action to protect their systems. Here are some recommended steps:

• Apply Patches: Ensure that the latest patches from Quest for KACE SMA are applied without delay.
• Conduct Security Audits: Regularly audit your systems for vulnerabilities, and ensure configurations comply with security best practices.
• Monitor Network Activity: Implement network monitoring solutions to identify unusual or suspicious activities.
• Educate Employees: Provide training for employees on recognizing phishing attempts and other social engineering tactics that may facilitate attacks.
• Backup Data: Regularly back up data and ensure that backup systems are secure and isolated from the primary network.

Conclusion

The exploitation of CVE-2025-32975 serves as a stark reminder of the importance of timely patch management and the vigilance required in cybersecurity practices. As cyber threats evolve, organizations must prioritize their security posture to protect against such vulnerabilities. By taking proactive measures, businesses can minimize their risk and safeguard their information assets against malicious actors.