CVE-2025-32976: Quest KACE SMA 2FA Bypass Vulnerability

CVE-2025-32976 Overview

CVE-2025-32976 is an authentication bypass vulnerability in the Quest KACE Systems Management Appliance (SMA). The flaw resides in the two-factor authentication (2FA) implementation and allows authenticated users to bypass Time-based One-Time Password (TOTP) validation. An attacker with valid first-factor credentials can elevate access without satisfying the second authentication factor. The weakness is classified under CWE-288: Authentication Bypass Using an Alternate Path or Channel.

Critical Impact

Authenticated attackers can bypass TOTP-based 2FA on Quest KACE SMA, defeating a key control protecting administrative interfaces and enabling lateral movement across managed endpoints.

Affected Products

• Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385 and 13.1.x before 13.1.81
• Quest KACE Systems Management Appliance (SMA) 13.2.x before 13.2.183
• Quest KACE Systems Management Appliance (SMA) 14.0.x before 14.0.341 (Patch 5) and 14.1.x before 14.1.101 (Patch 4)

Discovery Timeline

• 2025-06-24 - CVE-2025-32976 published to the National Vulnerability Database (NVD)
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-32976

Vulnerability Analysis

The Quest KACE SMA enforces TOTP-based 2FA as part of its login workflow for privileged users. CVE-2025-32976 stems from a logic flaw in how the appliance validates the second factor after primary credential submission. An authenticated user can manipulate the 2FA validation step to bypass the TOTP check entirely. The bypass grants the attacker elevated session privileges that should require both factors.

The vulnerability impacts the confidentiality, integrity, and availability of the appliance. KACE SMA manages patching, configuration, and software deployment across enterprise endpoints. A compromised administrative session can therefore be leveraged to push malicious software, alter device policy, or exfiltrate inventory data across the managed estate.

Root Cause

The root cause is improper enforcement of the 2FA state machine in the authentication flow. The appliance trusts a state transition that an authenticated user can influence, allowing the second-factor verification step to be skipped or marked as completed without a valid TOTP submission. This is a classic [CWE-288] alternate-path authentication weakness rather than a cryptographic flaw in TOTP itself.

Attack Vector

Exploitation requires network access to the KACE SMA web interface and valid first-factor credentials. The attacker submits credentials and then manipulates the 2FA validation request to bypass the TOTP requirement. No user interaction beyond the attacker's own session is needed. Refer to the Seralys CVE-2025-32976 Research and the Full Disclosure mailing list post for the disclosed technical specifics.

No verified proof-of-concept code has been published to a public exploit database, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-32976

Indicators of Compromise

• Successful administrative logins to KACE SMA that do not include a corresponding TOTP validation event in the authentication logs.
• Privileged session activity originating from accounts that have 2FA enrolled but show no recent successful TOTP submission.
• Unexpected configuration, patch deployment, or scripting jobs created shortly after login from atypical source IP addresses.

Detection Strategies

• Audit KACE SMA authentication logs for inconsistencies between primary authentication success and TOTP verification events.
• Correlate administrator session events with network access records to identify logins from unusual geolocations or networks.
• Alert on creation or modification of scripted installations, agent policies, or new admin accounts immediately following login events.

Monitoring Recommendations

• Forward KACE SMA web and authentication logs to a centralized logging or SIEM platform for retention and correlation.
• Monitor for repeated failed primary authentication attempts followed by an immediate successful login that lacks a 2FA challenge record.
• Track outbound connections from KACE-managed endpoints for signs of mass deployment of unauthorized software.

How to Mitigate CVE-2025-32976

Immediate Actions Required

• Upgrade KACE SMA to a fixed release: 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5), or 14.1.101 (Patch 4) or later.
• Restrict network access to the KACE SMA administrative interface to trusted management networks only.
• Rotate credentials for all KACE SMA administrative accounts following the upgrade.
• Review audit logs for any sessions that bypassed the TOTP step prior to patching.

Patch Information

Quest has released fixed builds across all supported branches. Consult the Quest Response to KACE SMA Vulnerabilities advisory for the canonical patch matrix covering CVE-2025-32975 through CVE-2025-32978.

Workarounds

• Place the KACE SMA web interface behind a VPN or IP allowlist until patches are applied.
• Enforce strong, unique passwords for all administrator accounts to raise the cost of obtaining valid first-factor credentials.
• Increase audit log review cadence and require manual approval for high-impact actions such as scripted package deployment.

# Example: restrict access to the KACE SMA web UI at the network edge
# Replace 10.0.0.0/24 with your trusted management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP