Supermicro BMC: IPMI fails to enforce session integrity, letting crafted packets run commands

Impact

The BMC does not correctly enforce the integrity and encryption requirements it negotiated for an IPMI session, so an attacker who can inject packets toward an active session can execute arbitrary IPMI commands. IPMI command execution on a BMC is full out-of-band control of the server: power cycle, console redirection, boot device selection, and on many platforms a path to persistent firmware-level access that survives reimaging the host OS. For a GPU fleet this is the worst class of management-plane bug - a single reachable BMC subnet turns into node-level control over machines that are expensive to drain and whose tenants cannot be evicted quickly. Supermicro published this under its October 2026 BMC/IPMI advisory alongside a separate RAKP+ privilege-escalation issue (CVE-2026-65220); the records list X12SPI, so check the advisory for the full board list.

Who can reach it

Anyone with network reach to the BMC's IPMI service - in practice anyone on the management VLAN. No authentication is required (AV:N/PR:N); the attacker needs an active IPMI session to target, not credentials of their own.

What to do

Apply the BMC firmware update from Supermicro's October 2026 BMC/IPMI advisory; the NVD record names no fixed firmware version, so take it from the advisory for your exact board. BMC firmware flashing is done out of band and typically does not require the host to be powered off, but plan on taking the node out of service for the flash window and verifying the BMC comes back before returning it to the pool. Until flashed, the mitigation that actually holds is network: confine IPMI to an isolated management VLAN with no tenant or general-corporate reachability, and disable IPMI-over-LAN where Redfish alone will do.

References

Related entries

• Cisco Nexus 9000: unauthenticated remote code execution as root via Silicon One ports in the default L3 VRFCVE-2026-20212 · Cisco Nexus 9000 NX-OS Silicon One integration (S1HAL, TCP 43210/43211)Critical
• Linux kernel nvmet-tcp - PDU iovec construction and H2C Transfer Tag handling: nvmet_tcp_build_pdu_iovec() walks pastCVE-2026-23112 · Linux kernel nvmet-tcp - PDU iovec construction and H2C Transfer Tag handlingCritical
• Linux kernel (drivers/infiniband/core): The iWARP connection manager returns work items to a free list while the sameCVE-2026-45898 · Linux kernel (drivers/infiniband/core)Critical
• Linux kernel - RDMA/rxe memory region translation, drivers/infiniband/sw/rxe/rxe_mr.c: Rxe mishandles memory regionsCVE-2026-46325 · Linux kernel - RDMA/rxe memory region translation, drivers/infiniband/sw/rxe/rxe_mr.cCritical
• Linux kernel NVMe-oF TCP target (nvmet-tcp, unpropagated PDU iovec build errors): Nvmet_tcp_build_pdu_iovec() detectsCVE-2026-52989 · Linux kernel NVMe-oF TCP target (nvmet-tcp, unpropagated PDU iovec build errors)Critical
• Linux kernel - iSER (iSCSI Extensions for RDMA) target, drivers/infiniband/ulp/isert/ib_isert.c: The iSER targetCVE-2026-53176 · Linux kernel - iSER (iSCSI Extensions for RDMA) target, drivers/infiniband/ulp/isert/ib_isert.cCritical