Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems

Threat actors are actively exploiting CVE-2025-32975 (CVSS 10.0), an authentication bypass flaw in Quest KACE Systems Management Appliance (SMA), to hijack administrative accounts.

• •Arctic Wolf observed malicious activity starting March 9, 2026, targeting unpatched SMA systems exposed to the internet.
• •The vulnerability allows attackers to impersonate legitimate users without credentials, enabling full administrative account takeover.
• •Attackers delivered Base64-encoded payloads via curl from an external server (216.126.225[.]156) and created additional admin accounts using runkbot.exe.
• •Post-exploitation activity included credential harvesting with Mimikatz, RDP access to backup infrastructure (Veeam, Veritas) and domain controllers, and Windows Registry modifications for persistence.