KACE Systems Management Appliance vulnerabilities | LiveThreat CVE Feed

Product

KACE Systems Management Appliance

by Quest · last CVE Jul 27, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities22 In the news3 Timeline

Severity mix

Critical 9High 7Medium 6Low 0

Severity

All severities22 Critical9 High7 Medium6 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add KACE Systems Management Appliance to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-32975 In wildKEV	10.0	2%	Jun 24	Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability Affected: 13.0 before 13.0.385; 13.1 before 13.1.81; 13.2 before 13.2.183; 14.0 before 14.0.341; 14.1 before 14.1.101
CVE-2021-32088	9.8	1%	Jul 27	An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273 Affected: 11.0.273
CVE-2021-32084	9.8	1%	Jul 27	An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273 Affected: 11.0.273
CVE-2021-32086	9.8	0%	Jul 27	An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273 Affected: 11.0.273
CVE-2022-29807	9.8	1%	Aug 2	A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php Affected: before 12.1.168
CVE-2022-30285	9.8	1%	Aug 2	In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication Affected: before 12.1.168
CVE-2019-12918	9.8	1%	Nov 6	Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection Affected: 9.1.317
CVE-2017-12567	9.8	1%	Aug 7	SQL injection exists in Quest KACE Asset Management Appliance 6.4.120822 through 7.2, Systems Management Appliance 6.4.120822 through 7.2.101, and K1000 as a Service 7.0 through… Affected: 6.4.120822; 7.0; 7.0.121306; 7.1; 7.1.149; 7.2; +1 more
CVE-2025-26850	9.3	0%	Jul 4	The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems Affected: before 14.0.97; 14.1.0 before 14.1.19
CVE-2021-32085	8.8	1%	Jul 27	An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273 Affected: 11.0.273
CVE-2021-32087	8.8	1%	Jul 27	An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273 Affected: 11.0.273
CVE-2019-13079	8.8	1%	Nov 6	Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection Affected: 9.1.317
CVE-2019-13078	8.8	1%	Nov 6	Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection Affected: 9.1.317
CVE-2019-13076	8.8	1%	Nov 6	Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection Affected: 9.1.317
CVE-2022-29808	7.5	1%	Aug 2	In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled Affected: before 12.1.168
CVE-2019-10973	7.2	2%	Jul 8	Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting tools located in the… Affected: 8.0.0 through 8.0.320; 8.1.0 through 8.1.108; 9.0.0 through 9.0.270
CVE-2022-38220	6.1	1%	Mar 1	An XSS vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.1 that may allow remote injection of arbitrary web script or HTML Affected: through 12.1
CVE-2019-13077	6.1	1%	Nov 6	Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the sam_detail_titled.php SAM_TYPE parameter) that allows an attacker to create a… Affected: 9.1.317
CVE-2019-12917	6.1	1%	Nov 6	A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/software_library.php component via the PATH_INFO Affected: 9.1.317
CVE-2019-11604	6.1	2%	May 24	An issue was discovered in Quest KACE Systems Management Appliance before 9.1 Affected: before 9.1
CVE-2019-13081	5.4	1%	Nov 6	Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the title field in the /common/ticket_associated_tickets.php service desk ticket… Affected: 9.1.317
CVE-2019-13080	5.4	1%	Nov 6	Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via an SVG image and HTML file) that allows an authenticated user to execute arbitrary… Affected: 9.1.317