Supermicro BMC: IPMI session integrity and encryption are not enforced, allowing command injection into a live session

CVSS 7.5CVE-2026-18449Firmware, BMC & network fabriccurated

Impact

The BMC accepts IPMI commands that do not meet the integrity and confidentiality requirements negotiated for the session, so an attacker who can place packets on the wire can have arbitrary IPMI commands executed inside an already-authenticated session. On a GPU node that means out-of-band control of a machine whose BMC can power-cycle it, remap boot, open KVM, and read sensor and inventory data - all without touching the host OS or the GPUs. CVSS is scored confidentiality-only (7.5), so treat the confirmed effect as disclosure through an active session rather than proven full takeover. Because every node in a rack shares one management network, a single reachable BMC exposes the management path to the whole fleet.

Who can reach it

Network reachable, no authentication of the attacker's own: anyone who can send IPMI/RMCP+ traffic to the BMC's management interface - that is, anyone on the management VLAN - and who can get packets associated with an active session.

What to do

Apply the Supermicro BMC firmware update referenced in the October 2026 IPMI advisory for the affected X12SPI boards. BMC firmware flashing is done out of band and generally does not require the host to be powered off, but plan for the BMC to reset and for IPMI/KVM sessions to drop; schedule it with the node drained if your tooling depends on BMC health checks. Until flashed, keep BMCs on an isolated management VLAN with no route from tenant or corporate networks and restrict IPMI (UDP 623) to the management jump hosts.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-18449 https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.