Supermicro BMC: OS command injection in a management function executes on service restart

Impact

An authenticated high-privilege BMC user can inject a shell command into a BMC configuration field; the payload runs when the related BMC service restarts. That gives code execution on the baseboard management controller itself, which sits below the host OS and outside every tenant boundary and host-side agent. A compromised BMC can power-cycle the node, mount virtual media, reflash firmware, and read host console and KVM traffic, so a GPU node with a tampered BMC cannot be trusted again until the management firmware is reflashed. Because BMCs are usually reachable from one flat management VLAN, one set of leaked or shared BMC credentials turns this into fleet-wide reach.

Who can reach it

Network access to the BMC management interface, with high-privilege (administrator-level) BMC credentials. Not reachable from a tenant GPU pod unless the management network is exposed to workloads.

What to do

Apply the BMC firmware update from Supermicro's October 2026 BMC/IPMI advisory for the affected board. Flashing BMC firmware is done out of band and the BMC reboots, so schedule it with the node drained if you depend on the BMC for health and power control during the flash; the host OS itself does not need to reboot. Until flashed, keep BMC interfaces off routable networks, restrict them to a jump host, and rotate BMC administrator credentials. The advisory text available here does not list a fixed firmware version number - check the Supermicro page for the exact build for your board.

References

Related entries

• Perle IOLAN STS/SCS terminal server (firmware before 6.0): A logged-in user of the restricted admin shell (TelnetCVE-2026-23759 · Perle IOLAN STS/SCS terminal server (firmware before 6.0)High
• Supermicro BMC SMTP service configuration handler on AS-2115HS-TNR and related boards: Crafted characters injectedCVE-2026-3820 · Supermicro BMC SMTP service configuration handler on AS-2115HS-TNR and related boardsHigh
• Supermicro BMC: authenticated IPMI Administrator can read and write BMC physical memory and run code on the BMC OSCVE-2026-65211 · Supermicro BMC (IPMI interface, arbitrary physical memory read/write)High
• Dell OMSA: high-privileged remote user escalates beyond their assigned OMSA roleCVE-2026-81445 · Dell OpenManage Server Administrator (privilege management, admin-level)High
• Dell OMSA: remote heap overflow gives code execution to a high-privileged accountCVE-2026-81477 · Dell OpenManage Server Administrator (remote heap-based buffer overflow)High
• Dell OMSA: remote stack overflow gives code execution to a high-privileged accountCVE-2026-81480 · Dell OpenManage Server Administrator (stack-based buffer overflow)High