Critical · 9.8 CVE-2021-32088 EUVD-2021-34857GHSA-wr85-vcm8-q7f4

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to…

Published Jul 27, 2026 · Updated Jul 28, 2026 · Assigned by mitre

Description

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie.

References

https://support.quest.com/download-product-select
https://support.quest.com/kace-systems-management-appliance/kb/4293505/quest-response-to-criticalstart-vulnerability-report