Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Supermicro X12SPI BMC lets unauthorized IPMI commands run

CVE-2026-18450 · published 1 day ago
Summary

The management controller in Supermicro X12SPI servers does not properly check that IPMI commands are protected with integrity and encryption. An attacker who can intercept an active session could send crafted packets to run any command they choose. Apply the latest firmware update from Supermicro that adds proper validation for these commands.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
smci x12spi 01.07.20
Original advisory text
Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
CVE-2026-18450 · NVD
CVE-2026-18450 · MITRE
Track software like this
Free during beta