Supermicro BMC: crafted RAKP+ messages escalate an IPMI account to administrator

Impact

A logic flaw in the BMC's RAKP+ handling lets a holder of any low-privilege IPMI account escalate to administrator. Administrator on a BMC means power control, serial-over-LAN console, virtual media, boot order and user management on that server - effectively ownership of the node independent of whatever the host OS enforces. Read-only or operator-level IPMI credentials are routinely handed out to monitoring systems, smart-hands vendors and automation, and are often shared across a whole rack, so the blast radius of one leaked low-privilege credential becomes every board that shares it. This is a different mechanism from the session-integrity bypass published in the same Supermicro October 2026 advisory (CVE-2026-18450), which needs no credential at all. The records name MBD-X12SPI; consult the advisory for the full affected board list.

Who can reach it

Network reach to the BMC's IPMI service plus any low-privilege IPMI account (AV:N/PR:L). In practice: anyone on the management VLAN who holds or can obtain a non-admin BMC credential.

What to do

Flash the BMC firmware fix from Supermicro's October 2026 BMC/IPMI advisory; the NVD record states no fixed version, so get it from the advisory for your board. Expect to take each node out of service for the flash and post-flash verification, and schedule it together with CVE-2026-18450 since both are fixed in the same advisory - one maintenance window, not two. Interim steps: audit and prune low-privilege BMC accounts, rotate any shared IPMI credentials, and keep the IPMI interface on an isolated management network.

References

Related entries

• MikroTik RouterOS: pre-auth btest session leaks kernel buffer data and can restart the deviceCVE-2026-67277 · MikroTik RouterOS (btest bandwidth test service)High
• Dell OpenManage Enterprise: authenticated SQL injection exposes management database contentsCVE-2026-71176 · Dell OpenManage Enterprise (SQL injection)High
• Linux KVM - intra-host migration/mirroring of SEV-SNP VMs: KVM allowed intra-host migration and mirroring of SEV-SNPCVE-2026-72286 · Linux KVM - intra-host migration/mirroring of SEV-SNP VMsHigh
• Linux kernel (drivers/infiniband/hw/bnxt_re): The variable-WQE send-queue slot count came straight from userspace withCVE-2026-72497 · Linux kernel (drivers/infiniband/hw/bnxt_re)High
• Linux bnxt_re RoCE driver (CQ toggle page use-after-free): The completion-queue variant of the toggle-pageCVE-2026-72499 · Linux bnxt_re RoCE driver (CQ toggle page use-after-free)High
• Linux bnxt_re RoCE driver (SRQ toggle page use-after-free): A use-after-free in the Broadcom RoCE driver — the toggleCVE-2026-72500 · Linux bnxt_re RoCE driver (SRQ toggle page use-after-free)High