CVE-2025-32978 Missing authorization in n/a
Unauthenticated attackers can replace system licenses via the web interface, causing denial of service in Quest KACE SMA.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32978?
CVE-2025-32978 is a high-severity missing authorization vulnerability in n/a, published on 24 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to replace system licenses through a web interface intended for license renewal. Attackers can exploit this to replace valid licenses with expired or trial licenses, causing denial of service.
Weakness: CWE-306
Which versions are affected by CVE-2025-32978?
How do I fix CVE-2025-32978?
No fix has been published for CVE-2025-32978 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-32978 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32978 exists.
Sources
Also known as GHSA-j3hf-8524-26c2.