CVE-2026-18450: Supermicro BMC unprotected IPMI commands on active RMCP+ sessions

CVE-2026-18450 · Severity: critical · CVSS 9.8 · Published 2026-10-27

Supermicro server baseboard management controllers (BMCs) that handle remote management do not properly enforce encryption and integrity checks on IPMI commands within active sessions. An attacker can craft malicious packets to execute arbitrary commands on a server without authentication, potentially gaining complete control of the system and data stored on it.

Technologies: Supermicro BMC Firmware. Vendors: Supermicro.

Quick answers

Is CVE-2026-18450 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-18450 being exploited in the wild.
How severe is CVE-2026-18450?
Critical severity, with a CVSS score of 9.8, published 27 October 2026.
Which products and versions are affected?
Supermicro BMC Firmware Affects X13, H13, X12, H12, and other series prior to specific fixed versions per motherboard model; Supermicro MBD-X13DAI-T prior to 01.08.18; Supermicro MBD-X13DDW-A prior to 01.13.09; Supermicro MBD-X13DEG-QT prior to 01.08.16; and 6 more.
Is there a fix for CVE-2026-18450?
Yes: fixed in See affected product list for motherboard-specific fixed firmware versions; representative fixes include MBD-X13DEG-QT 01.08.16, MBD-X13DEG-R 01.13.11, MBD-X13DAI-T 01.08.18, MBD-X13DEI 01.09.15, and dozens of additional models with corresponding firmware versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18450 attacked?
It is attacked over the network, in device firmware.
Am I affected by CVE-2026-18450?
Check whether you run Supermicro BMC Firmware, Supermicro MBD-X13DAI-T, Supermicro MBD-X13DDW-A or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: See affected product list for motherboard-specific fixed firmware versions; representative fixes include MBD-X13DEG-QT 01.08.16, MBD-X13DEG-R 01.13.11, MBD-X13DAI-T 01.08.18, MBD-X13DEI 01.09.15, and dozens of additional models with corresponding firmware versions

Technical details

The BMC's RMCP+ session handling fails to enforce integrity and encryption requirements, allowing an attacker to inject unencrypted or unprotected IPMI commands into an active authenticated session. This is a network-accessible vulnerability requiring no prior authentication or user interaction. An attacker gains arbitrary code execution on the BMC with full system compromise potential.

Affected products

  • Supermicro BMC firmware Affects X13, H13, X12, H12, and other series prior to specific fixed versions per motherboard model
  • Supermicro MBD-X13DEG-QT prior to 01.08.16
  • Supermicro MBD-X13SET-GC prior to 01.08.16
  • Supermicro MBD-X13SET-G prior to 01.08.16
  • Supermicro MBD-X13QEH+ prior to 01.08.16
  • Supermicro MBD-X13DEG-R prior to 01.13.11
  • Supermicro MBD-X13DDW-A prior to 01.13.09
  • Supermicro MBD-X13DAI-T prior to 01.08.18
  • Supermicro MBD-X13DEI-T prior to 01.09.15
  • Supermicro MBD-X13DEI prior to 01.09.15

Timeline

  • 2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.