CVE-2025-26850

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jul 5, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-268529.8DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection.CVE-2025-268539.8DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema.CVE-2025-268549.8A SQL injection in Articles Good Search extension 1.0.0 - 1.2.4.0011 for Joomla allows attackers to execute arbitrary SQL commands.CVE-2025-268559.8A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands.CVE-2025-268567.2Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE a CVE-2025-268575.3Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).CVE-2025-268587.5A buffer overflow vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted set of netw CVE-2025-268598.5RemoteView PC Application Console versions prior to 6.0.2 contain an uncontrolled search path element vulnerability. If a crafted DLL is pla CVE-2025-26866.5A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as CVE-2025-268608.5RemoteCall Remote Support Program (for Operator) versions prior to 5.1.0 contain an uncontrolled search path element vulnerability. If a cra CVE-2025-268618.5RemoteCall Remote Support Program (for Operator) versions prior to 5.3.0 contain an uncontrolled search path element vulnerability. If a cra CVE-2025-268620.0Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication