CVE-2021-32084: Critical severity Quest KACE Systems Deployment Appliance (SMA) vulnerability
Published Jul 27, 2026
·Updated
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE.
Affected Software
2 affected components
Quest KACE Systems Deployment Appliance (SMA)=11.0.273
Quest KACE Systems Management Appliance=11.0.273
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If restricting access to the KACE Systems Deployment Appliance (SMA) web console by IP address/subnets, also restrict access to the API endpoints using network controls (e.g., firewall/ACL) so that API traffic is limited to the same permitted IPs/subnets.
Event History
Jul 27, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeaknessAffected Software