Supermicro BMC Unprotected IPMI Commands (CVE-2026-18450)

Supermicro says its BMC "does not correctly enforce integrity and encryption requirements for IPMI commands." An attacker may craft packets that run arbitrary commands on an active session. A BMC, or baseboard management controller, is the small computer on a server board that admins use to manage the server remotely.

Supermicro rates CVE-2026-18450 Critical, 9.8 in CVSS 3.1, with the vector AV:N/AC:L/PR:N/UI:N. The CVE record and NVD carry only this CVSS 3.1 score from Supermicro. The runZero team, whose researchers found the flaw, gives its own CVSS 3.1 estimate of 8.1 High, with high attack complexity (AC:H).

How the Check Is Skipped

IPMI sessions over the network use RMCP+, which agrees on a cipher suite when a session opens. Cipher suites 3 and 17 promise that every command is signed and encrypted. The runZero advisory says the Supermicro IPMI service never compares an incoming packet with that promise.

Instead, it reads two bits in the packet header. If the "authenticated" and "encrypted" bits are both clear, the command skips the signature check and the decryption step. It is still run. The runZero team says it saw this on an X13 unit with firmware 1.07, for both cipher suites.

Why the Two Scores Differ

The attacker needs more than network access. The runZero team says a live, activated session must already exist on the BMC, and the attacker must know its session ID. That is why its estimate uses high attack complexity.

runZero adds that monitoring tools that poll servers over IPMI often keep such sessions open. Someone who can watch the network traffic can read a session ID in cleartext. The team says predictable session IDs may offer a second route. It has not shown that one client can hijack another's session, and Supermicro disputes that impact.

runZero says the BMC runs injected commands at that session's privilege. If the session belongs to an administrator, so do the commands. Its wider BMC research warns that control of a BMC may enable lateral movement or persistence across managed infrastructure.

The Other Eight CVEs

The same advisory lists seven more CVEs, and a second advisory on the same day adds CVE-2026-16521. Supermicro scores all of them in CVSS 3.1 only.

CVE	What Supermicro says it allows	CVSS 3.1	Attacker needs
CVE-2026-65220	Crafted RAKP+ messages raise an account to administrator.	8.8 High	A low-privilege IPMI account.
CVE-2026-18449	A hardcoded key in SMCRAKP may help crack a password hash.	7.5 High	Network access, no account.
CVE-2026-65219	Out-of-order RAKP messages open an RMCP+ session.	7.4 High	Network access, no account.
CVE-2026-65211	Read and write of BMC physical memory, then code on the BMC.	7.2 High	An IPMI administrator.
CVE-2026-16521	OS command injection in the BMC syslog feature.	7.2 High	High privileges.
CVE-2026-65213	Commands as the root user on the BMC.	6.6 Medium	An IPMI administrator.
CVE-2026-65210	Read of any file on the BMC.	4.9 Medium	An IPMI administrator.
CVE-2026-18451	A guessable launch token lets an attacker take over the HTML5 KVM console.	3.1 Low	Network access and a user action.

runZero says several of these combine. CVE-2026-18449 lets a remote attacker sign in as an enabled IPMI user when the optional SMCRAKP mode is on. CVE-2026-65219 gave a restricted session and the host's serial console on the X11 and H13 systems it tested.

CVE-2026-65220 raised a low-privilege user to administrator on the X10 and X11 systems runZero tested. That administrator access can then reach the file read in CVE-2026-65210 or the memory access in CVE-2026-65211. The runZero team says the memory write can give persistent control of the BMC.

Supermicro credits runZero for the eight CVEs in its first advisory. It credits Jihye Lee, an independent researcher at Korea University, for CVE-2026-16521.

What Supermicro and CISA KEV Say About Exploitation

These are the public signals we checked on 31 October 2026.

The eight Blackhole posts repeat the CVE record text for seven of the nine CVEs. They add nothing beyond the records, and we have not verified them. On X, CSIRT Italia flagged the Supermicro update on 30 October. Read the CSIRT Italia post on X (@csirt_it, 30 October).

Our explainer on the Supermicro BMC vulnerability scores shows why the session ID matters, and what to change on the network.

Supermicro's advisory of 26 October 2026 lists one fixed BMC firmware version per product, for all eight CVEs together. In the copy archived on 27 October, the table has 402 rows: 390 motherboards, 10 SSE switches and 2 CMM-6 modules. Supermicro says every affected motherboard SKU needs a BMC update.

The table does not say which CVE affects which board. The runZero advisory says CVE-2026-18450 affects Supermicro BMCs before X14. So treat the fixed version for your board as the target, whatever its family.

Most families have many different fixed versions, so look up your exact board. For example, the X12SPi-TF fix is 01.07.27, the H13SSF fix is 01.09.19 and the X11DPT-PS fix is 01.74.26. Two boards, X12DGU and X13SEW-TF-OS1, show "TBD" instead of a version.

Supermicro adds that it is still testing and validating affected products. It asks users to check the release notes of each firmware for the fix.

Boards Missing From the Table

runZero's advisory names X9 (X9DRT-HF), X10 and X11 boards as affected by CVE-2026-18450. Supermicro's table lists no X9 or X10 board. Where no fixed firmware is listed, keep the BMC off any shared network and ask Supermicro support; that is our advice, not a vendor statement.

The second advisory, for CVE-2026-16521, has its own product table, so check your board there as well. Our vulnerability management process guide covers how to plan and track a firmware rollout.