CVE-2026-3821: Supermicro BMC command injection in SMASH services

CVE-2026-3821 · Severity: high · CVSS 8.8 · Published 2026-07-22

Supermicro server motherboards use a Baseboard Management Controller (BMC) to allow administrators to manage hardware remotely. A vulnerability in the SMASH management service could allow an authorized user to execute unauthorized commands on this controller. This could lead to a total loss of system control, data integrity issues, or a permanent shutdown of the server (Denial of Service).

Technologies: Supermicro BMC Firmware. Vendors: Supermicro.

Quick answers

Is CVE-2026-3821 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-3821 being exploited in the wild.
How severe is CVE-2026-3821?
High severity, with a CVSS score of 8.8, published 22 July 2026.
Which products and versions are affected?
Supermicro BMC Firmware 01.00.16.00, 1.03.02.06; Supermicro X14DBG-DAP BMC Firmware 01.00.16.00, 1.03.02.06; Supermicro X14DBI BMC Firmware 01.00.16.00, 1.03.02.06.
Is there a fix for CVE-2026-3821?
A patch was published on 2026-07-22: Fixed firmware versions released for various motherboard models Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3821 attacked?
It is attacked over the network, in device firmware.
Am I affected by CVE-2026-3821?
Check whether you run Supermicro BMC Firmware, Supermicro X14DBG-DAP BMC Firmware or Supermicro X14DBI BMC Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the SMASH (Systems Management Architecture for Server Hardware) services of Supermicro BMC firmware. The flaw stems from improper neutralization of special elements within the SMASH input capability. An authenticated attacker with low privileges can exploit this over the network to execute arbitrary code with the privileges of the BMC service, potentially compromising the entire management subsystem or triggering a Denial-of-Service (DoS) state. The vulnerability affects multiple motherboard families including X12, X13, X14, and H12/H13/H14 series. Remediation requires updating the BMC firmware to the fixed versions specified in the Supermicro security advisory.

Affected products

  • Supermicro X14DBG-DAP BMC Firmware 01.00.16.00, 1.03.02.06
  • Supermicro X14DBI BMC Firmware 01.00.16.00, 1.03.02.06
  • Supermicro BMC Firmware (various motherboards) See advisory for full list of affected motherboard SKUs

Timeline

  • 2026-07-22: disclosed
  • 2026-07-22: advisory
  • 2026-07-22: patched: Fixed firmware versions released for various motherboard models

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.