Supermicro Patches Eight BMC Flaws in 392 Server Boards

X (Twitter) Facebook Pinterest LinkedIn E-mail

Supermicro has released firmware to fix eight vulnerabilities in the baseboard management controller (BMC) of its servers, including a critical one, CVE-2026-18450, with a CVSS score of 9.8. The advisory, dated October 26, 2026, affects 392 motherboard models and chassis management modules and credits the discovery to researchers at runZero. According to the vendor, the most severe flaw allows an attacker to send crafted packets that execute IPMI commands within an active session without needing credentials.

The Supermicro BMC vulnerabilities in 30 seconds

There are eight CVEs in the BMC’s IPMI and KVM functions: one critical, four high, two medium and one low.
Three can be exploited without credentials, including CVE-2026-18450, rated CVSS 9.8.
The advisory lists 392 boards and modules from the X11-to-X14 and H11-to-H14 families, plus ten switches.
Two boards still lack fixed firmware, and Supermicro says it is not aware of any real-world attacks.

The BMC is a small computer embedded in the motherboard that lets administrators power a server on or off, reinstall it, or open its console remotely, even when the operating system is down. That’s why a flaw in this component has more reach than one in an application: whoever controls the BMC can act on the machine below the operating system and many of its defenses. On Supermicro servers, that access is offered through the IPMI protocol, a web interface and an HTML5 KVM console.

Three Flaws Exploitable Without Credentials

The most severe vulnerability, CVE-2026-18450, stems from the BMC failing to properly enforce the integrity and encryption requirements for IPMI commands. According to Supermicro, an attacker could craft packets that execute arbitrary commands within an RMCP+ session already opened by a legitimate user. The CVSS 3.1 vector published by the vendor indicates network access, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity and availability.

Two other flaws also require no authentication. CVE-2026-18449 (CVSS 7.5) stems from a hardcoded key inside the BMC’s SMCRAKP implementation, which could help decrypt a password hash. CVE-2026-65219 (CVSS 7.4) allows an attacker, by sending an out-of-order RAKP message, to establish an RMCP+ session from which to execute commands, although its attack complexity is high. RAKP is the key exchange IPMI 2.0 uses to authenticate sessions, and it was already the subject of public research in 2013 over the way it exposed password hashes.

The remaining vulnerabilities require prior access. CVE-2026-65220 (CVSS 8.8) lets a low-privilege user escalate their account to administrator through crafted RAKP+ messages. With IPMI administrator permissions, CVE-2026-65211 (7.2) grants read and write access to the BMC’s physical memory and, with it, code execution on its operating system; CVE-2026-65213 (6.6) allows commands to be run as root, and CVE-2026-65210 (4.9) allows arbitrary files on the filesystem to be read. The mildest, CVE-2026-18451 (3.1), affects the token used to open the KVM console, which is generated from the time and could be guessed to hijack the session.

Chained together, these flaws describe a complete path: getting in without credentials or with a low-level account, escalating to administrator, and ending up executing code as root on the BMC. Supermicro says it has no evidence of malicious use of these vulnerabilities, and for now they do not appear in the catalog of exploited vulnerabilities maintained by the US agency CISA.

392 Boards Affected, Two Still Without a Patch

The advisory’s product table lists 402 entries. 392 are motherboards and modules — the figure that has been widely reported — and the other ten are switches from the SSE-T series. By family, the largest group is X11, with 102 entries, followed by X12 (69), X14 (57) and X13 (49) on the Intel side, and H12 (24), H13 (21), H14 (12) and H11 (9) on the AMD side. The list also includes boards for blade servers, several A3, M12 and R12 references, and two chassis management modules.

Each entry is tied to the BMC firmware version that contains the fix, which varies by family; on several X13 boards, for instance, it is version 01.08.16. Two models, MBD-X12DGU and MBD-X13SEW-TF-OS1, still show the fixed version as “TBD” — in other words, pending. The advisory itself mixes two messages: it says the updated firmware already exists while also stating that Supermicro is still testing and validating the affected products, and it refers readers to each board’s release notes.

The same day, Supermicro published a second BMC advisory covering a different vulnerability, CVE-2026-16521 (CVSS 7.2). It is a command injection in the syslog function that can be triggered when the corresponding service restarts; it was discovered by Jihye Lee, an independent researcher at Korea University, and affects 378 entries. Its summary mistakenly repeats that there are eight issues, when it describes only one. Some sources, such as the wiki maintained by German integrator Thomas-Krenn, lump the two advisories together and talk about nine CVEs, and that same page gives CVE-2026-18450 a score of 9.2, different from the 9.8 that appears in Supermicro’s advisory and in the public CVE record.

Lights Out: runZero’s Research Into BMCs

The eight vulnerabilities are part of Lights Out, the research runZero announced on August 5, 2026 covering flaws in several BMC implementations. At the time, the company’s list included OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM and Fujitsu, and it said technical details would follow as coordinated disclosure wrapped up with each vendor. It presented the overall findings at Black Hat and DEF CON.

Supermicro’s advisory is, therefore, one of the first closures of that process, and other vendors on the list are likely to publish their own bulletins. Security at this layer of the server has gained weight with AI deployments, where vendors such as Nuvoton and AMI are already bringing OpenBMC with a hardware-rooted root of trust to new platforms.

What Administrators Should Do

Supermicro says every affected board needs a BMC firmware update. The first step is to find each server’s exact model in the advisory’s table and compare the installed version against the fixed one; those who buy through an integrator can find validated versions in their downloads area, as Thomas-Krenn recommends to its customers. On the two pending boards, and until the rest are updated, the most effective measure is the one that keeps getting repeated year after year: keeping the management interface unreachable from the internet — the same lesson that recent management-interface vulnerabilities in other systems have reinforced.

runZero recommends limiting management access to trusted IP addresses or internal subnets, isolating BMCs on a dedicated management network or behind a VPN, and tightening monitoring of any access that remains open. It also advises setting up a formal process for patching BMCs across all vendors, something many organizations lack because management firmware tends to fall outside the usual update cycles. Since one of the vulnerabilities can expose password hashes, it is also worth changing BMC credentials after updating.

Sources:

Frequently Asked Questions

What is CVE-2026-18450?

CVE-2026-18450 is a critical vulnerability (CVSS 9.8) in the BMC of Supermicro servers. It lets an attacker send crafted packets that execute arbitrary IPMI commands inside an RMCP+ session already opened by a legitimate user, without needing any credentials.

Which boards are affected by the Supermicro BMC vulnerabilities?

The advisory lists 392 affected motherboards and chassis management modules, spanning the X11 to X14 and H11 to H14 families, plus ten SSE-T series switches. Two models, MBD-X12DGU and MBD-X13SEW-TF-OS1, still have no fixed firmware available.

Has CVE-2026-18450 been exploited in the wild?

Supermicro says it has no evidence that any of the eight vulnerabilities have been exploited maliciously, and as of this report none of them appear in CISA’s catalog of known exploited vulnerabilities.

How can administrators protect their servers until they patch?

runZero recommends keeping BMC management interfaces off the public internet, restricting access to trusted IP addresses or internal subnets, isolating BMCs on a dedicated management network or behind a VPN, and changing BMC credentials after updating, since one of the flaws can expose password hashes.

This article is also available in Spanish: «Supermicro corrige ocho fallos en el BMC de 392 placas, uno con CVSS 9,8», on revistacloud.com.