Advisory · CVE-2026-18450
Supermicro BMC accepts unprotected IPMI commands on active RMCP+ sessions, allowing command execution
Supermicro BMC firmware does not correctly enforce integrity and encryption requirements for IPMI commands, so an attacker who can reach the BMC may craft packets that execute arbitrary commands on an active RMCP+ session. The vendor rates it critical at CVSS 3.1 9.8 and lists per-model fixed BMC firmware for 402 motherboard SKUs.
- Vendor
- Supermicro
- Product
- BMC firmware
- Identifier / CWE
- CVE-2026-18450
CWE-306 - Action timing
- Immediate
Explain it like I’m five
The BMC is the small separate computer that manages a server even when the server itself is off. On affected firmware it accepts powerful management commands on an existing session without properly checking that the commands are genuine and protected, so an attacker who can reach that management port may be able to give the BMC orders it should never have taken from them.
- 01Attacker reaches the BMC
The attacker has network access to a server's BMC IPMI interface, for example on a management network that is wider than intended.
- 02Active session targeted
An RMCP+ session is active, or is established, on the affected BMC firmware.
- 03Crafted packets sent
The attacker crafts IPMI packets for that session, relying on the BMC not correctly enforcing integrity and encryption requirements for the commands.
- 04Commands accepted
Per the vendor bulletin, the crafted packets can execute arbitrary commands on the active session.
- 05Management control gained
Commands running at the BMC level act below the host operating system, outside the visibility of host agents and logs.
What happened
Supermicro published a BMC firmware bulletin on October 26, 2026 covering eight security issues in select boards, crediting runZero researchers and stating it is not aware of malicious use in the wild. CVE-2026-18450 is the bulletin’s only critical issue, rated CVSS 3.1 9.8, with the issue type given as unprotected IPMI commands accepted on active RMCP+ sessions: the BMC does not correctly enforce integrity and encryption requirements for IPMI commands, and an attacker may be able to craft packets that execute arbitrary commands on an active session (CWE-306 in the NVD record, which names the X12SPI BMC at firmware 01.07.20 in its affected data).
The bulletin does not state a single affected firmware range or a single fixed version. Its affected products table lists 402 motherboard SKUs, each paired with the per-model BMC firmware version that contains the fix, and two SKUs are still marked to be determined. Per the bulletin, every affected SKU will require a BMC update to mitigate the issue; updated firmware has been created and the vendor is testing and validating affected products, so the per-model version in the bulletin table and the product release notes are the update reference for each board.
What to do
- Inventory Supermicro servers and identify each board model, including systems in colocation, labs, and spare pools.
- For each model, check the affected products table in the Supermicro bulletin and note the BMC firmware version listed as containing the fix for that model; two models are still listed as to be determined, so recheck the bulletin for those.
- Update each BMC to its per-model fixed firmware version from the bulletin, following the vendor release notes for that board.
- Until every BMC is updated, isolate BMC and IPMI interfaces on a dedicated management network with strict access control; a BMC should never be reachable from the internet or from general user networks.
- Review BMC and IPMI logs for sessions and commands from unfamiliar sources or at unusual times, and inventory BMC user accounts.
- Verify the BMC firmware version on each board after updating, and record the version against the asset.
Management note
A BMC is control of the server below the operating system: power, console, virtual media, and firmware. A flaw that lets crafted packets run commands on it bypasses every control that lives on the host. Keep BMC networks small and unreachable by default, and patch this per board model, because the fixed version is different across the fleet.