Paper/Archive/CVE-2025-26850

CVE-2025-26850

Quest KACE Systems Management Appliance — The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalati…

EPSS 0.2%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 7.8.078 × 201.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.

Affected

ProductAffectedFixed inSource

KACE Systems Management Appliance< 14.0.9714.0.97CNA

KACE Systems Management Appliance14.1.0 – < 14.1.1914.1.19CNA

Scores by source

mitre (CNA)9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.quest.com/kb/4378559/quest-response-to-kace-sma-agent-vulnerability-cve-2025-26850