Supermicro BMC: authenticated IPMI administrator can read arbitrary files from the BMC filesystem

CVSS 4.9CVE-2026-65210Firmware, BMC & network fabriccurated

Impact

An authenticated IPMI administrator reads any file on the BMC filesystem, well past what the management role is supposed to expose. In practice that means BMC configuration, stored credentials and hashes, certificates and private keys, and whatever else the controller keeps on disk. The value to an attacker is lateral movement: material recovered from one BMC frequently unlocks the rest of the management plane, because datacenter fleets provision BMCs from a common image with common secrets. Confidentiality only - no write and no availability impact - but it is the step that turns a single compromised management account into fleet-wide access.

Who can reach it

Network reachable on the BMC management interface, authenticated as an IPMI administrator. Low attack complexity.

What to do

Flash the fixed BMC firmware from Supermicro's October 2026 BMC/IPMI advisory. The flash is out of band but resets the BMC, so schedule it when the node is not relying on remote console or virtual media. Treat any secret stored on an exposed BMC - local IPMI passwords, TLS keys, Redfish accounts - as disclosed and rotate it after patching, since the fix does not undo a read that already happened.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-65210 https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.