ZeusQA
Start free

Known exploited vulnerabilities

Quest vulnerabilities attackers have used

Every Quest vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 2 Quest vulnerabilities as exploited in the wild, 1 of them added in the last 12 months and 1 used in ransomware campaigns. The most recent is CVE-2025-32975, added Apr 20, 2026. KACE System Management Appliance has the most entries (1).

In KEV, all time
2
Added, last 12 months
1
Used in ransomware
1
New CVEs this week
0

By product

KACE System Management Appliance (1), KACE Systems Management Appliance (SMA) (1).

Every Quest entry in CISA KEV

  1. CVE-2025-32975

    Added · due

    Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

    Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.

  2. CVE-2018-11138

    RansomwareAdded · due

    Quest KACE System Management Appliance Remote Command Execution Vulnerability

    The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works