CVE-2021-32086

CriticalCVSS 9.8/10Last modified Aug 3, 2026

Description

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain privileged access to unrelated systems or services.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-321

Affected software

No affected versions have been published.

Timeline

Published: Jul 27, 2026
Last modified: Aug 3, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-320878.8An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp acco CVE-2021-320889.8An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to CVE-2021-320899.8An issue was discovered on Zebra (formerly Motorola Solutions) Fixed RFID Reader FX9500 devices. An unauthenticated attacker can upload arbi CVE-2021-320909.8The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.CVE-2021-320916.1A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.CVE-2021-320926.1A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remo CVE-2021-320936.5The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files vi CVE-2021-320948.8U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.CVE-2021-320958.1U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.CVE-2021-320968.8The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary R CVE-2021-320989.8Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.CVE-2021-320999.8A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his u