Advisory · CVE-2026-65220
Supermicro BMC RAKP+ flaw lets a low-privilege IPMI account escalate to administrator
A logic flaw in Supermicro BMC IPMI handling lets an attacker with a low-privilege account send specially crafted RAKP+ messages and escalate that account to administrator privileges on the BMC. The vendor rates it high at CVSS 3.1 8.8 and lists per-model fixed BMC firmware for 402 motherboard SKUs.
- Vendor
- Supermicro
- Product
- BMC firmware
- Identifier / CWE
- CVE-2026-65220
CWE-269 - Action timing
- Immediate
Explain it like I’m five
The BMC's sign-in handshake can be tricked by specially shaped messages. Someone who holds only a minor account on the management controller can use that trick to promote their own account to full administrator, which means full control of the server underneath its operating system.
- 01Low-privilege account held
The attacker holds a valid low-privilege IPMI account on an affected BMC, as reflected in the CVSS privileges-required rating.
- 02Crafted RAKP+ messages sent
The attacker sends specially crafted RAKP+ messages to the BMC session establishment handling.
- 03Logic flaw triggers
Per the vendor bulletin, a logic flaw in the BMC IPMI implementation mishandles those messages.
- 04Account escalated
The attacker's account is escalated to administrator privileges on the BMC.
- 05Full management control
As BMC administrator, the attacker controls the server below its operating system, including power, console, and firmware paths.
What happened
Supermicro’s BMC firmware bulletin of October 26, 2026, which covers eight security issues in select boards and credits runZero researchers, lists CVE-2026-65220 as a high severity privilege escalation rated CVSS 3.1 8.8: a logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges (CWE-269 in the NVD record, which names the MBD-X12SPI BMC at firmware 01.07.20 in its affected data). The vendor states it is not aware of malicious use of these vulnerabilities in the wild.
As with the rest of that bulletin, there is no single affected range or single fixed version: the affected products table lists 402 motherboard SKUs, each with the per-model BMC firmware version that contains the fix, and two SKUs are still marked to be determined. Per the bulletin, every affected SKU will require a BMC update; updated firmware has been created and is being tested and validated, so use the per-model version in the bulletin table and the board’s release notes as the update reference.
What to do
- Inventory Supermicro servers and identify each board model, then check the bulletin’s affected products table for the BMC firmware version listed as containing the fix for that model.
- Update each BMC to its per-model fixed firmware version, following the vendor release notes; recheck the bulletin for the two models whose fixed version is still to be determined.
- Audit BMC and IPMI accounts on every affected board: remove accounts you do not recognize, delete shared and default accounts, and confirm every remaining low-privilege account is still needed, because any one of them is an escalation starting point.
- Restrict BMC and IPMI access to a dedicated management network while remediation is underway; the BMC should not be reachable from user networks or the internet.
- Review BMC logs for RAKP+ session anomalies, privilege changes, and new administrator accounts, and rotate BMC administrator credentials after patching if anything looks off.
- Verify the BMC firmware version on each board after updating.
Management note
Privilege escalation on the management controller converts the weakest BMC account into ownership of the machine beneath its operating system. Patch per board model, then treat the BMC account list itself as part of the remediation, because this flaw prices every low-privilege account at administrator value.