Quest · KACE System Management Appliance

CVE-2018-11138

Quest KACE System Management Appliance Remote Command Execution Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 92%

What it is

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.

CISA: The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: April 15, 2022

Added to the CISA list: March 25, 2022
Published: May 31, 2018
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 92% in the top 0.2% of all known vulnerabilities
Weakness: CWE-78
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Quest

Added	Vulnerability	Product	Severity	Attack chance
Apr 20, 2026	Improper AuthenticationCVE-2025-32975	KACE Systems Management Appliance (SMA)	Critical 10.0	2.5%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.