Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-18450 EUVD-2026-110633GHSA-4gmh-3v9m-9469

Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability

Published Oct 27, 2026 · Updated Nov 4, 2026 · Assigned by Supermicro

Description

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

Affected products

VendorProductAffectedFixed
SMCI X12SPI 01.07.20 —

References