CVE-2019-20504: Quest KACE Systems Management

Critical severity, CVSS 9.8. EPSS: 9.6% chance of exploitation in the next 30 days.

service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code via shell metacharacters in the kuid parameter.

Affected products

• Quest KACE Systems Management: before 6.4.120822 (fixed in 6.4.120822)

Published 2020-03-09. Last modified 2026-06-17.