CVE-2021-32088: Quest KACE SDA Auth Bypass Vulnerability

CVE-2021-32088 Overview

CVE-2021-32088 is a rate-limiting bypass in Quest KACE Systems Deployment Appliance (SMA) version 11.0.273. Certain API endpoints enforce rate limiting to slow brute-force attacks against authentication and other sensitive operations. Attackers can bypass this protection by removing the kboxid cookie from their HTTP requests. Without the cookie, the appliance fails to associate requests with a tracked session and does not apply throttling. The weakness is classified under [CWE-384] Session Fixation and enables high-volume credential guessing against network-exposed management endpoints.

Critical Impact
Removing the kboxid cookie disables brute-force protection on Quest KACE SMA 11.0.273 API endpoints, allowing unrestricted credential guessing over the network.

Affected Products

Quest KACE Systems Deployment Appliance (SMA) 11.0.273
Quest KACE Systems Management Appliance API endpoints protected by kboxid-based rate limiting
Deployments exposing the KACE management interface to untrusted networks

Discovery Timeline

2026-07-27 - CVE-2021-32088 published to the National Vulnerability Database (NVD)
2026-07-28 - Record last modified in NVD

Technical Details for CVE-2021-32088

Vulnerability Analysis

Quest KACE SMA enforces rate limiting on selected API endpoints to reduce the effectiveness of automated brute-force attempts. The throttling logic keys off the kboxid session cookie, which the server issues and uses to correlate repeated requests from a single client. When the appliance receives a request that does not include a kboxid value, the rate-limit counter is never incremented against a tracked identifier.

An attacker can submit repeated authentication requests without the cookie and avoid throttling entirely. This turns endpoints that would otherwise resist password guessing into unrestricted brute-force targets. The CWE-384 classification reflects the session-management flaw: state tied to a client-supplied identifier can be discarded to bypass security controls.

Root Cause

The rate limiter tracks request counts by the kboxid cookie value rather than by a server-derived identifier such as source IP, authentication attempt target, or a required session token. Requests with a missing cookie are treated as untracked and skip the throttling path instead of being rejected or bucketed under a default counter.

Attack Vector

Exploitation requires only network reachability to the KACE SMA management interface. The attacker sends HTTP requests to a protected API endpoint, strips or omits the kboxid cookie, and iterates through credential pairs or other sensitive parameters. Because no user interaction or prior authentication is required, remote attackers can automate large-scale password spraying against valid accounts, including administrative users.

See the Quest KACE Vulnerability Response advisory for vendor guidance.

Detection Methods for CVE-2021-32088

Indicators of Compromise

High volumes of HTTP requests to KACE SMA API endpoints that lack the kboxid cookie header.
Repeated authentication failures against the same or multiple accounts originating from a single source IP or subnet.
Successful logins immediately following bursts of failed attempts, indicating a completed brute-force sequence.

Detection Strategies

Inspect web server and application logs for requests where the Cookie header omits kboxid on endpoints known to enforce rate limiting.
Correlate authentication failure counts per source IP over short time windows to identify throttling that should have engaged but did not.
Baseline normal API traffic patterns and alert on deviations in request rate or cookie composition.

Monitoring Recommendations

Forward KACE SMA access logs to a central SIEM and build detections for cookie-stripped requests against /api/ paths.
Monitor administrative account login activity for anomalous geographies, user agents, or times.
Enable network flow monitoring in front of the appliance to identify sustained scanning or credential-guessing traffic.

How to Mitigate CVE-2021-32088

Immediate Actions Required

Restrict network access to the KACE SMA management interface using firewall rules or VPN-only access.
Enforce strong, unique passwords and multi-factor authentication on all administrative and user accounts.
Review authentication logs on affected appliances for evidence of prior brute-force activity.

Patch Information

Quest addresses the issue in updated releases of the KACE Systems Management Appliance. Download the latest fixed version from the Quest Product Download Page and follow the vendor guidance in the Quest KACE Vulnerability Response knowledge base article.

Workarounds

Place the KACE SMA behind a reverse proxy or web application firewall that enforces IP-based rate limiting independent of the kboxid cookie.
Block or throttle requests to authentication endpoints that arrive without a valid session cookie.
Lock accounts after a defined number of consecutive failed authentications to limit brute-force effectiveness.

bash

# Example: NGINX front-end rate limiting by source IP for KACE endpoints
limit_req_zone $binary_remote_addr zone=kace_api:10m rate=5r/m;

server {
    listen 443 ssl;
    server_name kace.example.com;

    location /api/ {
        limit_req zone=kace_api burst=10 nodelay;
        proxy_pass https://kace-backend.internal;
    }
}