CVE-2026-18449

Supermicro BMC contains a SMCRAKP Fixed Key vulnerability

At a glance

Severity: HIGH 7.5
EPSS: EPSS 0.34 % · percentile 27 (2026-10-27)
State: PUBLISHED
Published: 2026-10-27
Updated: 2026-10-27
Assigner: Supermicro
NVD status: Awaiting Analysis

Description

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	Supermicro
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · def9a96e-e099-41a9-bfac-30fd4f82c411 (Secondary)

Weaknesses (CWE)

CWE-798

European references

ENISA EUVD · EUVD-2026-110623
GCVE · GCVE-0-2026-18449

Affected products

Product	Versions
SMCI · X12SPI	affected 01.07.20

References

https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD