CVE-2021-32084: Quest KACE SMA Auth Bypass Vulnerability

CVE-2021-32084 Overview

CVE-2021-32084 is an access control weakness in Quest KACE Systems Deployment Appliance (SMA) version 11.0.273. The appliance allows administrators to restrict web console access by IP address or subnet. However, this restriction does not extend to the API endpoints exposed by the same appliance. An attacker who possesses valid credentials or API keys can bypass the IP-based restriction entirely by targeting the API surface directly. Successful exploitation grants full API-level control over the appliance and can lead to compromise of the KACE-managed environment.

Critical Impact
Network-based attackers with known credentials or API keys can bypass IP allowlisting on the KACE SMA and gain full control over the appliance and any endpoints it manages.

Affected Products

Quest KACE Systems Deployment Appliance (SMA) 11.0.273
Quest KACE Systems Management Appliance deployments relying on IP-based web console restrictions
Environments where KACE API keys or administrative credentials are shared or exposed

Discovery Timeline

2026-07-27 - CVE-2021-32084 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2021-32084

Vulnerability Analysis

The vulnerability is an improper access control issue tracked under [CWE-284]. Quest KACE SMA exposes two logical interfaces to remote users: the administrative web console and a programmatic API. Administrators can configure IP address or subnet allowlists to constrain who can reach the web console. That control does not apply to API endpoints on the same appliance.

An attacker holding valid credentials or an API key can reach the API from any network location, even from IP ranges explicitly excluded by the web console policy. Because the appliance manages system deployment and configuration for downstream endpoints, API access effectively provides administrative control of the managed environment.

Root Cause

The root cause is inconsistent enforcement of the network-layer access policy. The IP allowlist is applied only to the web console handler and not to the API request handler. This creates a policy gap between two interfaces that share the same authentication material and privilege model.

Attack Vector

Exploitation is network-based and requires no user interaction. The attacker needs a valid credential or API key belonging to the KACE appliance. Common paths to obtain such credentials include leaked automation scripts, exposed configuration files, phishing of administrators, or reuse of credentials found in unrelated breaches. Once authenticated to the API, the attacker can invoke management functions that would normally be gated behind the restricted web console.

No public proof-of-concept code has been published for this issue. Refer to the Quest Vulnerability Response Document for vendor guidance.

Detection Methods for CVE-2021-32084

Indicators of Compromise

API requests to the KACE appliance originating from source IP addresses that fall outside the configured web console allowlist.
Successful API authentications using service accounts or API keys during off-hours or from unexpected geographies.
Unexpected deployment, imaging, or configuration jobs initiated through the API rather than the web console.

Detection Strategies

Enable verbose API access logging on the KACE appliance and forward events to a central log platform for correlation.
Baseline legitimate API client IP addresses and alert on any new source addresses interacting with API endpoints.
Correlate API authentication events with contemporaneous web console access events to identify divergence from expected administrator behavior.

Monitoring Recommendations

Monitor authentication logs for reuse of KACE API keys across multiple source addresses within short time windows.
Track creation, modification, or export of deployment packages, scripts, and provisioning tasks through the API.
Alert on changes to appliance user accounts, role assignments, or API key issuance events.

How to Mitigate CVE-2021-32084

Immediate Actions Required

Rotate all KACE administrative credentials and API keys, prioritizing accounts used by automation or shared across teams.
Place the KACE appliance behind a network firewall or reverse proxy that enforces the same IP allowlist for both the web console and API paths.
Review recent API activity for unauthorized calls and revoke any API keys that cannot be attributed to a specific owner.

Patch Information

Quest has published guidance in the Quest Vulnerability Response Document. Administrators should upgrade beyond 11.0.273 using the Quest Product Download Page and apply any configuration hardening steps identified by the vendor.

Workarounds

Enforce IP restrictions at a network device in front of the appliance so both API and web console traffic are filtered identically.
Restrict API key issuance to named service accounts, store keys in a secrets manager, and rotate them on a defined schedule.
Require multi-factor authentication for administrative accounts and disable any API keys that are not actively used.

bash

# Example: restrict access to KACE appliance at the network edge (iptables)
# Replace 10.10.0.0/24 with the approved management subnet
iptables -A INPUT -p tcp -d <KACE_APPLIANCE_IP> --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp -d <KACE_APPLIANCE_IP> --dport 443 -j DROP