CVE-2018-11138 — Quest KACE System Management Appliance Remote Command Execution Vulnerability

Known ransomware use CISA KEV listed Added March 25, 2022 Remediate by April 15, 2022

Description

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2018-11138

Need help remediating this vulnerability?

Our team helps organizations patch, mitigate, and respond to CISA KEV advisories fast.

Talk to an engineer