PT-2026-65306 · Quest · Kace Systems Deployment Appliance
CVE-2021-32084
·
Published
2026-07-27
·
Updated
2026-08-03
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Quest KACE Systems Deployment Appliance (SMA) version 11.0.273
Description
An issue exists where API endpoints are not subject to the same IP address or subnet restrictions applied to the web console. If an attacker possesses valid credentials or API keys, they can bypass these network restrictions to access the appliance via the API, potentially compromising the entire configured KACE environment.
Recommendations
Update Quest KACE Systems Deployment Appliance (SMA) version 11.0.273 to a version that enforces IP restrictions on API endpoints.
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kace Systems Deployment Appliance