Supermicro BMC: authenticated IPMI administrator can execute commands as root on the BMC

CVSS 6.6CVE-2026-65213Firmware, BMC & network fabriccurated

Impact

An IPMI account at administrator level escapes the IPMI command surface and runs arbitrary commands as root on the BMC's own operating system. That turns a management credential into full control of the out-of-band controller: persistent firmware-resident code that survives host reinstalls, the ability to read or rewrite BMC configuration and credentials, virtual media and power control over the node, and a foothold on the management network that host-side tooling cannot see. On a GPU fleet where BMC credentials are commonly shared or templated across hundreds of identical boards, one leaked administrator password becomes root on every BMC that uses it. Supermicro rates it 6.6 and notes high attack complexity; the privilege requirement is what keeps the score down, not the consequence.

Who can reach it

Network reachable on the BMC management interface, authenticated as an IPMI administrator. No host access and no physical access needed.

What to do

Apply the BMC firmware update from Supermicro's October 2026 BMC/IPMI advisory for the affected boards. BMC firmware flashing is done out of band and does not require the host OS to be down on Supermicro platforms, but the BMC itself resets during the update, so plan for loss of remote console, virtual media and IPMI power control for the duration and avoid flashing nodes mid-job. Until flashed, keep the BMC network isolated from tenant and general corporate networks and reduce the number of administrator-level IPMI accounts; the advisory does not list a configuration-only mitigation.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-65213 https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.