What is the CVSS score of CVE-2025-26850?

CVE-2025-26850 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Quest KACE Systems Management Appliance are affected by CVE-2025-26850?

Quest KACE Systems Management Appliance versions before 14.0.97 and 14.1.x before 14.1.19 contain a critical privilege escalation vulnerability affecting managed endpoints.. A patch is available.

How to fix or mitigate CVE-2025-26850?

Within 24 hours: Inventory all KACE SMA deployments and identify instances running versions 14.0.x (pre-14.0.97) or 14.1.x (pre-14.1.19). Within 7 days: Apply vendor patches-upgrade to KACE SMA 14.0.97 or later for version 14.0.x installations, and 14.1.19 or later for version 14.1.x installations. Within 30 days: Validate patch deployment across all managed systems, review privilege escalation logs for suspicious activity, and audit administrative account usage on recently patched endpoints.

Quest KACE Systems Management Appliance CVE-2025-26850

EUVD-2025-20096 CRITICAL

Incorrect Authorization (CWE-863)

2025-07-05 cve@mitre.org

Privilege Escalation Authentication Bypass

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:52 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

14.0.97,14.1.19

EUVD ID Assigned

Mar 16, 2026 - 03:19 euvd

EUVD-2025-20096

Analysis Generated

Mar 16, 2026 - 03:19 vuln.today

CVE Published

Jul 05, 2025 - 00:15 nvd

CRITICAL 9.3

DescriptionCVE.org

The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.

Analysis

The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.

Technical ContextAI

Privilege escalation allows a low-privileged user or process to gain elevated permissions beyond what was originally authorized. This vulnerability is classified as Incorrect Authorization (CWE-863).

RemediationAI

Apply the principle of least privilege. Keep systems patched. Monitor for suspicious privilege changes. Use mandatory access controls (SELinux, AppArmor).