---
id: "CVE-2018-11138"
kind: "vulnerability"
aliases: ["CVE-2018-11138"]
title: "Quest KACE System Management Appliance: Quest KACE System Management Appliance Remote Command Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.91719
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Quest KACE System Management Appliance", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Quest KACE System Management Appliance", "fixed": ["7.0.121307", "7.1.150", "7.2.103", "8.0.320", "8.1.108", "9.0.270"], "affected": "< 7.0.121307 (7.x line), < 7.1.150, < 7.2.103, < 8.0.320, < 8.1.108, < 9.0.270", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["appliance", "exploited", "infrastructure", "quest-kace", "ransomware", "self-hosted", "unauthenticated-rce"]
not_affected_if: ["unknown"]
published_at: "2018-05-31T18:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-11138", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-11138", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:20:42+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11138", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Quest KACE System Management Appliance: Quest KACE System Management Appliance Remote Command Execution Vulnerability

Quest KACE SMA's /common/download_agent_installer.php is reachable without authentication and lets an attacker inject OS commands via the orgid parameter (chained with a time-based SQLi to learn required parameters), giving remote code execution as the web server user, with a documented root-privilege-escalation chain via the Sudo Server module. CISA KEV lists it as actively exploited, including in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Quest KACE System Management Appliance affected ? fixed ?
- vendor:Quest KACE System Management Appliance affected < 7.0.121307 (7.x line), < 7.1.150, < 7.2.103, < 8.0.320, < 8.1.108, < 9.0.270 fixed 7.0.121307, 7.1.150, 7.2.103, 8.0.320, 8.1.108, 9.0.270

## How to check

From outside the appliance, send an unauthenticated GET to http://<kace-host>/common/download_agent_installer.php?platform=windows&serv=<sha256>&orgid=1&version=<agent-version>. If the appliance responds (rather than 404/redirect-to-login), the endpoint is exposed and the appliance is likely unpatched if its build predates the fixed builds below. Confirm the installed SMA build number in the admin console (Settings > Support > appliance version) against the fixed builds.

## Fix

Apply Quest patch SEC2018_20180410 (support.quest.com KB 4210065), or upgrade to a build that already contains it: 7.0.121307, 7.1.150, 7.2.103, 8.0.320, 8.1.108, or 9.0.270 and later. The hotfix reboots the appliance.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-11138
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-11138
- 2026-10-23T21:20:42+00:00 analyst — Primary sources: Core Security CORE-2018-0004 (section 7.1) confirms the unauthenticated command-injection path via /common/download_agent_installer.php, exploiting an SQLi in the orgid parameter to inject OS commands (root cause). Vendor fix is Quest KB 4210065 (patch SEC2018_20180410): fixes shipped in SMA 7.0.121307, 7.1.150, 7.2.103, 8.0.320, 8.1.108, and 9.0.270+; versions prior to these across the 7.x/8.x lines are vulnerable. Exploitability check: an unauthenticated GET to /common/download_agent_installer.php on the appliance (any response other than an auth redirect/404, e.g. HTTP 200 with agent-download behavior) indicates the endpoint is reachable and the instance is unpatched for this issue. No further patch history found post-9.0.270 for this specific CVE; vendor did not publish a CVSS score in the advisory but NVD/Rapid7 rate it 9.8 critical. CISA KEV confirms active exploitation (tags already note ransomware use).
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-11138

## Documents

- [advisory] CORE-2018-0004: Quest KACE SMA Multiple Vulnerabilities https://www.coresecurity.com/core-labs/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
- [fix] Quest KB 4210065: Security Vulnerability Patch (SEC2018_20180410) https://support.quest.com/kb/4210065/security-vulnerability-patch-sec2018_20180410

## From the sources

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_