CVE-2021-32086

If you're running KACE SMA, understand this clearly: the hardcoded symmetric key in CVE-2021-32086 is not a single-installation problem. The same key encrypts the credential vaults of every KACE SMA deployment worldwide. If an attacker obtains the MySQL database from any KACE installation—whether from an active compromise, an old backup, or an offsite storage archive—they can decrypt credentials that may grant access to your entire software deployment infrastructure, including domain service accounts, VMware integrations, SSH keys for build servers, and API tokens for cloud platforms. The CVSS 9.8 score measures the technical severity, but it obscures the real architectural problem. Gaining database access is easier than it should be because KACE backups are routinely stored offsite, shared with consultants, retained beyond their security shelf-life, or included in due diligence archives during mergers. None of those scenarios require an attacker to compromise your network directly. Here's what matters for your response: patching alone may be insufficient. Quest likely retained the old key in patched code for backward compatibility with existing credential vaults. This means the vulnerability persists in a different form—the universal key still exists in current production code, still decrypting old backup snapshots. If your organization upgraded in place without regenerating and re-encrypting credentials, you may be running 'patched' software while still exposed. The temporal exposure is worse than it appears. Even if you rotated all credentials after disclosure, any historical backup—2019, 2020, whenever the backup was taken—contains credentials encrypted with that same key. An attacker with access to an old backup has a complete window into every credential that existed at that time, regardless of subsequent rotation. The remediation timeline isn't 'when we patched' or 'when we rotated credentials'—it's theoretically the date the key was first provisioned, which no customer can determine. Prioritize these actions: treat every credential in your KACE vault as compromised and re-credential all integrated systems, not just KACE admin accounts. If you have any KACE backups predating the patch, treat them as stolen property—restrict access immediately. Verify with Quest whether your patch included a vault re-encryption mechanism, and if not, demand one. The blast radius of this vulnerability doesn't close with credential rotation; it closes only when every historical credential has been replaced and every old backup has been securely destroyed.

Reviewed through automated stages and approved by a human before publication.