CVE-2021-32088CWE-384

CVE-2021-32088

Critical · published July 28, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
43.0
In the wild
Unconfirmed
What it is

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00516 · 43.0th percentile
Weakness
CWE-384 · Session Fixation
Published
2026-07-28T02:16Z
Affected products (1)
ProductVersionsFixed in
quest/kace_systems_management_applianceall versions—
References (2)
https://support.quest.com/download-product-select · [email protected]https://support.quest.com/kace-systems-management-appliance/kb/4293505/quest-response-to-criticalstart-vulnerability-report · [email protected]
EPSS history
Timeline
  • 27 JUL 00:00Z
    An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
    cvelistv5