CVE-2025-32976 Auth bypass in n/a
Authenticated users can bypass TOTP-based two-factor authentication to gain elevated access on Quest KACE SMA appliances.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32976?
CVE-2025-32976 is a high-severity authentication bypass vulnerability in n/a, published on 24 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains a logic flaw in its two-factor authentication implementation that allows authenticated users to bypass TOTP-based 2FA requirements. The vulnerability exists in the 2FA validation process and can be exploited to gain elevated access.
Weakness: CWE-288
Which versions are affected by CVE-2025-32976?
How do I fix CVE-2025-32976?
No fix has been published for CVE-2025-32976 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-32976 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32976 exists.
Sources
Also known as GHSA-m359-p2w2-2pxh.