CVE-2026-65220

Supermicro BMC IPMI feature contains a Privilege escalation vulnerability

A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Smci

Products

Mbd-x12spi

CVE-2026-65219

Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Smci

Products

Mbd-x12spi

CVE-2026-65213

Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability

This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Smci

Products

Mbd-x12spi

CVE-2026-65211

Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability

This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Smci

Products

Mbd-x12spi

CVE-2026-65210

Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability

This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Smci

Products

Mbd-x12spi

CVE-2026-18451

Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token

The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Smci

Products

Mbd-x12spi

CVE-2026-18450

Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Smci

Products

X12spi

CVE-2026-18449

Supermicro BMC contains a SMCRAKP Fixed Key vulnerability

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Smci

Products

X12spi

CVE-2026-16521

Supermicro BMC's syslog feature contains a command injection vulnerability

An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Smci

Products

Mbd-x12stw-f

CVE-2026-3821

Supermicro SMASH service contain an Arbitrary code execution issue

Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Smci

Products

X14dbg-dap X14dbi

CVE-2026-3820

Supermicro BMC's SMTP service contains a command injection vulnerability

There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR.  An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation. Potential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Smci

Products

As-2115hs-tnr