https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-32088.htmlhttps://patchthecve.com/cve/CVE-2021-32088.htmlMon, 03 Aug 2026 14:30:47 +0000CRITICAL 9.8: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie.https://patchthecve.com/cve/CVE-2021-32087.htmlhttps://patchthecve.com/cve/CVE-2021-32087.htmlMon, 03 Aug 2026 14:31:17 +0000HIGH 8.8: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interfhttps://patchthecve.com/cve/CVE-2021-32086.htmlhttps://patchthecve.com/cve/CVE-2021-32086.htmlMon, 03 Aug 2026 14:30:59 +0000CRITICAL 9.8: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt thttps://patchthecve.com/cve/CVE-2021-32085.htmlhttps://patchthecve.com/cve/CVE-2021-32085.htmlMon, 03 Aug 2026 14:31:07 +0000HIGH 8.8: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the Myhttps://patchthecve.com/cve/CVE-2021-32084.htmlhttps://patchthecve.com/cve/CVE-2021-32084.htmlMon, 03 Aug 2026 14:31:11 +0000CRITICAL 9.8: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, lead