Supermicro BMC Vulnerabilities Hit 392 Boards, One Rated CVSS 9.8

TL;DR

Supermicro has disclosed eight Supermicro BMC vulnerabilities that affect 392 motherboard and module SKUs. The worst IPMI flaw, CVE-2026-18450, carries a critical CVSS score of 9.8. It lets an unauthenticated attacker run IPMI commands on an active session. Researchers at runZero found and reported all eight bugs.

Eight flaws hit the IPMI and KVM features of Supermicro BMC firmware. Three of them need no login, and one is rated critical. Supermicro has shipped fixed BMC firmware for most boards and says it is not aware of attacks.

Notable CVEs

Why It Matters

A baseboard management controller runs below the host operating system. It can power servers on and off, mount media, and open a remote console. As a result, an attacker who controls the BMC controls the server. In addition, these Supermicro BMC vulnerabilities sit in IPMI, a protocol that admins often expose on management networks.

The bugs come from runZero’s “Lights Out” BMC research. That project, announced in August, named Supermicro IPMI among eight affected BMC platforms.

How the Attack Works

Unauthenticated flaws

This critical IPMI flaw breaks session protection. According to the advisory, “The BMC does not correctly enforce integrity and encryption requirements for IPMI commands.” Consequently, an attacker “may be able to craft packets that execute arbitrary commands on an active session.”

Two other flaws also need no account. CVE-2026-18449 (CVSS 7.5) stems from a hardcoded key in SMCRAKP, “which may allow an attacker to crack a password hash.” Meanwhile, CVE-2026-65219 (CVSS 7.4) abuses out-of-order RAKP messages to open an RMCP+ session.

Authenticated flaws

CVE-2026-65220 (CVSS 8.8) lets a low-privilege user escalate an account to administrator. Three more bugs need IPMI admin rights. For example, CVE-2026-65211 could let an admin “read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.”

Finally, CVE-2026-18451 (CVSS 3.1) covers a weak, time-seeded KVM launch token. An attacker could guess it and hijack a console session.

Affected Versions

The advisory lists 392 SKUs. Most belong to the X11, X12, X13 and X14 Intel families. However, H11 to H14 AMD boards, A3SEV boards and CMM-6 chassis modules also appear. Two SKUs, including MBD-X13SEW-TF-OS1, still show a “TBD” fixed version.

Patch and Mitigation

Supermicro states, “All affected Supermicro motherboard SKUs will require a BMC update to mitigate these potential vulnerabilities.” Admins should match each board to its fixed firmware in the Supermicro BMC IPMI October 2026 security advisory.

Until updates land for these Supermicro BMC vulnerabilities, keep BMC interfaces off the internet and on an isolated management network. Also, rotate BMC passwords after patching, since one flaw exposes password hashes.

As for exploitation, “Supermicro is not aware of any malicious use of these vulnerabilities in the wild.” Furthermore, no public proof-of-concept has been confirmed, and CISA’s KEV catalog does not list these flaws.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.