Multiple security vulnerabilities have been identified in Supermicro baseboard management controller firmware, affecting 392 motherboard and module SKUs. The flaws impact IPMI and KVM functionality and can allow unauthenticated or low-privilege attackers to execute commands, escalate privileges, access memory, or hijack console sessions. Overall risk is high because the BMC operates below the host operating system and can control server power, media, and remote console access.
CVE-2026-18450 (CVSS 9.8 — Critical): This flaw in the IPMI command path results from missing authentication for a critical function, enabling an unauthenticated attacker to craft packets that execute arbitrary commands on an active session. The affected component is the BMC's IPMI session protection, where integrity and encryption requirements are not correctly enforced.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Supermicro baseboard management controller firmware, affecting 392 motherboard and module SKUs. The flaws impact IPMI and KVM functionality and can allow unauthenticated or low-privilege attackers to execute commands, escalate privileges, access memory, or hijack console sessions. Overall risk is high because the BMC operates below the host operating system and can control server power, media, and remote console access.
CVE-2026-18450 (CVSS 9.8 — Critical): This flaw in the IPMI command path results from missing authentication for a critical function, enabling an unauthenticated attacker to craft packets that execute arbitrary commands on an active session. The affected component is the BMC's IPMI session protection, where integrity and encryption requirements are not correctly enforced.[emaillocker id="1283"]
CVE-2026-65220 (CVSS 8.8 — High): This improper privilege management flaw in the BMC allows a low-privilege user to escalate an account to administrator. An attacker with a low-privilege account can gain elevated control over BMC functions.
CVE-2026-18449 (CVSS 7.5 — High): This use of hard-coded credentials in the BMC's authentication process exposes a fixed key that can be used to crack a password hash. An unauthenticated attacker may leverage the flaw to recover or compromise credentials.
CVE-2026-65219 (CVSS 7.4 — High): This incorrect behavior order flaw in the BMC's remote authentication process allows out-of-order messages to be processed in a way that opens a remote management session. An unauthenticated attacker can exploit the sequence issue to establish a session without proper authentication.
CVE-2026-65211 (CVSS 7.2 — High): This improper authentication flaw in the BMC allows an attacker with IPMI administrator rights to read and write arbitrary physical memory. The attacker can use that access to execute code on the BMC operating system.
CVE-2026-65213 (CVSS 6.6 — Medium): This OS command injection flaw in the BMC allows input to be passed to an operating system command interface. An attacker who can reach the vulnerable interface may execute arbitrary commands on the management controller.
CVE-2026-65210 (CVSS 4.9 — Medium): This files or directories accessible to external parties flaw in the BMC exposes files or directories to external parties. An attacker may access information stored on the management controller.
CVE-2026-18451 (CVSS 3.1 — Low): This predictable seed in the pseudo-random number generator affects the KVM launch token used by the BMC. An attacker may guess the token and hijack a console session.
These vulnerabilities collectively present a serious risk to systems whose management controllers are reachable from untrusted networks. Organizations that expose baseboard management interfaces or rely on weak administrative credentials are most at risk. The overall exposure warrants urgent attention.
We recommend you to refer below mention link to apply patches: https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1
The following reports contain further technical details:
[/emaillocker]