Supermicro BMC firmware: Unprotected IPMI commands on active RMCP+ sessions
Summary
The baseboard management controller (BMC) of select Supermicro motherboards does not correctly enforce integrity and encryption for IPMI commands. An attacker who can reach the BMC network interface and has an active RMCP+ session may craft packets that execute arbitrary commands. Exposure depends on network reachability and on monitoring tools keeping IPMI sessions open.
Affected
- Supermicro BMC firmware on select motherboards; the vendor advisory lists per-board affected versions.
- The CNA record lists SMCI X12SPI on version 01.07.20 as affected (default configuration: unaffected).
- runZero describes a broader scope including X9 to X12 and H13 boards; verify your exact board model.
Fixed in
Unknown. Check the vendor advisory for the fixed BMC firmware version per board.
Workaround
- Keep BMC and IPMI interfaces on a separate, tightly filtered management network with no internet exposure.
- Review IPMI monitoring integrations and close sessions where possible.
- Disable the optional SMCRAKP mode until the BMC is patched (see related CVE-2026-18449).
Exploitation
No known exploitation in the wild. Not listed in the CISA KEV catalog. No public proof-of-concept found at the time of research. EPSS: 0.4 % (percentile 34).
Our recommendation
- Inventory all Supermicro boards and BMC firmware versions.
- Confirm that no BMC or IPMI interface is reachable from the internet and restrict management network access.
- Disable SMCRAKP and review IPMI monitoring sessions.
- Apply the BMC firmware for each board from the vendor advisory as soon as it is available.
- Re-check NVD and the vendor page for updates; the NVD entry was still awaiting analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Supermicro security advisory (Oct 2026) www.supermicro.com
- runZero advisory CVE-2026-18450 www.runzero.com
- runZero advisory CVE-2026-18449 (SMCRAKP) www.runzero.com
- Rescana analysis CVE-2026-18450 www.rescana.com
- VulDB entry CVE-2026-18450 vuldb.com
- The Hacker Wire CVE-2026-18450 www.thehackerwire.com
- SecurityWeek: new Supermicro BMC vulnerabilities www.securityweek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:32.
Original description (NVD)
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.