CVE-2018-11138

quest kace system management appliance

Published 31 May 2018 · updated 13 Aug 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.

References

www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities · Exploit, Technical Description, Third Party Advisory
www.exploit-db.com/exploits/44950/ · Exploit, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11138 · US Government Resource