CVE-2021-32086 Details
Description
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain privileged access to unrelated systems or services.
A vulnerability exists in Quest KACE Systems Deployment Appliance (SMA) version 11.0.273, where a hardcoded symmetric encryption key is used to encrypt secrets in the MySQL database. This key is not unique to each installation. An attacker with access to the MySQL server or backup files can decrypt these secrets, which often leads to privilege escalation within KACE or unauthorized access to other systems and services.
Users can upgrade to KACE Systems Management Appliance version 11.1, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| quest kace systems management appliance | 11.0.273 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | Initial Analysis | [email protected] |
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |