Supermicro rates CVE-2026-18450 Critical, 9.8 in CVSS 3.1. runZero, whose researchers found it, puts the same flaw at 8.1 High. The gap comes down to one precondition: the attacker needs the ID of a live IPMI session first. This explainer walks through what that session ID is, why it moves the score, and what it changes for data center and infrastructure admins.
Supermicro published an advisory on 26 October 2026 with fixed BMC firmware for eight BMC flaws found by runZero, most of them in IPMI. CVE-2026-18450 is the worst of them. Details on all nine CVEs are on our CVE-2026-18450 vulnerability page.
What Is an IPMI Session?
A BMC (baseboard management controller) is the small computer on a server board that runs remote management. It stays reachable even when the server is off, as runZero’s research notes. IPMI is the protocol many BMCs use for that management.
Over the network, IPMI talks through sessions. When a session opens, the client and the BMC agree on a cipher suite. The runZero team says suites 3 and 17 promise that every command is signed and encrypted. Each session gets an ID, and each later packet carries that ID so the BMC knows which session it belongs to.
Where Does the Check Fail?
Supermicro says its BMC “does not correctly enforce integrity and encryption requirements for IPMI commands.” The runZero advisory explains how. The IPMI service looks up the session by its ID, then reads two bits in the packet header. It checks the signature only when the “authenticated” bit is set, and decrypts only when the “encrypted” bit is set.
It never compares those bits with the cipher suite the session agreed on. A packet with both bits clear skips the signature check and the decryption step, and the command still runs. The runZero team says it saw this on an X13 unit with firmware 1.07, for both cipher suites.
- Monitoring toolNetworkopens a signed, encrypted session
- On-path attackerNetworkreads the session ID in cleartext
- Unsigned commandNetworkboth header bits cleared
- IPMI serviceSupermicro BMCskips signature and decryption
- Command runsSupermicro BMC
Why Does the Session ID Split the Score?
Supermicro’s vector uses low attack complexity (AC:L) and no privileges (PR:N). The runZero estimate uses high attack complexity (AC:H) instead. Its October post says this reflects “the need to identify a live session ID before injecting commands.”
Two things must be true for the attack to work. A live, activated session must already exist on the BMC, and the attacker must know its ID. The runZero team says monitoring tools that poll servers over IPMI often keep such sessions open. Someone who can watch the network traffic can read a session ID in cleartext.
The team also says predictable session IDs may offer a second route. It has not shown that one client can hijack another’s session, and Supermicro disputes that impact. Both scores are CVSS 3.1, and the CVE record and NVD carry only Supermicro’s 9.8.
Which Other Flaws Skip the Precondition?
The session ID matters only for CVE-2026-18450. Two more high-rated flaws need no account and no live session. CVE-2026-18449 (7.5) and CVE-2026-65219 (7.4) both work over the network without credentials, by Supermicro’s scores.
The runZero team says CVE-2026-18449 lets a remote attacker sign in as an enabled IPMI user when the optional SMCRAKP mode is on. CVE-2026-65220 (8.8) turns a low-privilege IPMI account into an administrator. Three more flaws, CVE-2026-65210, CVE-2026-65211 and CVE-2026-65213, need an IPMI administrator.
So the lower runZero score for one CVE does not make the batch low risk. An attacker who cannot find a session ID has other doors on an unpatched board.
- CISA KEVNot seenNone of the nine CVEs is in catalog version 2026.10.3031 Oct
- Exploitation reported by SupermicroNot seenSupermicro says it is not aware of any malicious use in the wild26 Oct
- Fixed firmwareYes400 of 402 products in the advisory have a fixed BMC version27 Oct
- Alerts on XYes14 public posts from 26 to 31 October in five languages31 Oct
- Brandefense BlackholeYesEight Telegram posts on 27 October repeat the CVE records31 Oct
The Blackhole posts sit in CVE alert and news feed channels and add nothing beyond the records. On X, CSIRT Italia flagged the update on 30 October. Read the CSIRT Italia post on X (@csirt_it, 30 October).
What Changes for Defenders?
The precondition points at the network, not only at the firmware. If an attacker has to see IPMI traffic to read a session ID, the place where that traffic flows matters. The runZero team says IPMI should not be casually reachable from user networks, production segments or the internet.
On a flat network, one compromised machine can often reach far more than it should, and that can include BMCs. Our network segmentation glossary entry explains why. These are the changes that follow, in the order we would make them:
- Find every BMC you own. A server inventory may name the vendor and product but not the parts inside, such as the BMC, the runZero team writes. It suggests searching for anything that speaks IPMI or looks like a BMC.
- Map who can reach each one. Note which BMCs answer from user networks, production segments or the internet. Its October post adds that BMCs “can accidentally turn up outside dedicated management networks.”
- Match each board to the advisory. Look up the exact board model in Supermicro’s table and note the version in “BMC FW Version with the Fix”.
- Update the BMC firmware, starting with BMCs reachable outside the management network. Read the release notes, as Supermicro asks.
- Fence off IPMI. Allow access only from trusted IP addresses or internal subnets. Where full isolation is not possible, limit it to a VPN or a dedicated management network, and monitor the management paths that remain, as runZero advises.
- Cut the extra doors. Check whether the optional SMCRAKP mode is on, and remove IPMI accounts that nobody uses. That is our advice, not a vendor workaround.
runZero also publishes an open source scanner, oobscan, and says it can test for these flaws on test gear. For assets your inventory misses, see our External Attack Surface Management product.
Fewer administrator accounts also shrink the three flaws that need one. Keeping admin rights to the few people who need them follows the least privilege principle.
What If Your Board Has No Fix?
Two boards in the table, X12DGU and X13SEW-TF-OS1, show “TBD” instead of a version. The runZero advisory also names X9 and X10 boards for CVE-2026-18450, and Supermicro’s table lists no X9 or X10 board.
For these, the network is the main defence. Keep IPMI on a separate management network, and ask Supermicro support about a fix. Plan to replace boards that will not get one. Our vulnerability management guide covers how to track exceptions like these.