ACTIVELY EXPLOITED
CVE-2018-11138: Quest KACE System Management Appliance Remote Command Execution Vulnerability
| Vendor | Quest |
|---|---|
| Product | KACE System Management Appliance |
| Actively exploited | Yes |
| Added to CISA KEV | 25 Mar 2022 |
| CISA federal deadline | 15 Apr 2022 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-78 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.
SOURCES
Other Quest flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.