High-Risk Malware Attack Targets Quest KACE Systems Management Appliance
A severe security breach has been reported involving the Quest KACE Systems Management Appliance (SMA), prompting urgent warnings for affected users. Malicious activity detected by Arctic Wolf began around March 9, 2026, exploiting a critical authentication bypass vulnerability (CVE-2025-32975) that allows attackers to impersonate legitimate users.
This attack affects organizations using unpatched SMA systems exposed to the internet, with potential consequences including the complete takeover of administrative accounts. The attackers have been observed creating new administrative accounts and harvesting credentials, which could lead to further exploitation of network resources.
To mitigate the risk, administrators must immediately apply the latest software updates and ensure that SMA instances are not publicly accessible. Given the severity of the vulnerability and the ongoing malicious activity, this incident is classified as High Risk. Organizations are urged to remain vigilant and enhance their cybersecurity defenses.
Source: View Original Report
