CVE-2021-32086CWE-321

CVE-2021-32086

Critical · published July 28, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain privileged access to unrelated systems or services.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00329 · 24.8th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2026-07-28T02:16Z
Affected products (1)
ProductVersionsFixed in
quest/kace_systems_management_applianceall versions—
References (2)
https://support.quest.com/download-product-select · [email protected]https://support.quest.com/kace-systems-management-appliance/kb/4293505/quest-response-to-criticalstart-vulnerability-report · [email protected]
EPSS history
Timeline
  • 27 JUL 00:00Z
    An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
    cvelistv5