Live › vulnerability › CVE-2018-11138
Go to dashboardQuest KACE SMA's /common/download_agent_installer.php is reachable without authentication and lets an attacker inject OS commands via the orgid parameter (chained with a time-based SQLi to learn required parameters), giving remote code execution as the web server user, with a documented root-privilege-escalation chain via the Sudo Server module. CISA KEV lists it as actively exploited, including in ransomware campaigns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Quest KACE System Management Appliance | vendor | – | – |
| Quest KACE System Management Appliance | vendor | < 7.0.121307 (7.x line), < 7.1.150, < 7.2.103, < 8.0.320, < 8.1.108, < 9.0.270 | 7.0.121307, 7.1.150, 7.2.103, 8.0.320, 8.1.108, 9.0.270 |
7.0.121307, 7.1.150, 7.2.103, 8.0.320, 8.1.108, or 9.0.270 and laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2018-11138")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.