Quest: community verdicts

2 notable / known-exploited Quest CVEs the community has triaged.

ⓘ Not an exhaustive list: we focus on the findings that matter (exploited / notable). For every Quest CVE, see NVD ↗.

Tracked Quest CVEs by year published2 tracked · select a year for details

Show as table

Year published	CVEs	In CISA KEV
2018	1	1
2019	0	0
2020	0	0
2021	0	0
2022	0	0
2023	0	0
2024	0	0
2025	1	1

Exploitation first, with newly exploited CVEs rising above old ones

CVE-2018-11138CRIT 9.8KEVEPSS 92%
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
CVE-2025-32975CRIT 10KEVEPSS 2%
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.