Is CVE-2026-65210 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65210 being exploited in the wild.

How severe is CVE-2026-65210?

Medium severity, with a CVSS score of 4.9, published 27 October 2026.

Which products and versions are affected?

Supermicro BMC Firmware Multiple board models; see advisory for affected versions and fixes.

Is there a fix for CVE-2026-65210?

Yes: fixed in Varies by board model; examples include MBD-X13DEG-QT 01.08.16, MBD-X13SET-GC 01.08.16, MBD-X13SCL-F 01.14.01, MBD-X12SCA-F 01.16.01 (see advisory for complete list). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65210 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-65210?

Check whether you run Supermicro BMC Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65210: Supermicro BMC firmware arbitrary file access

CVE-2026-65210 · Severity: medium · CVSS 4.9 · Published 2026-10-27

Supermicro's Baseboard Management Controller (BMC) firmware, which manages hardware and remote server access, contains a flaw allowing authenticated administrators to read arbitrary files from the system. An attacker with IPMI administrator credentials can access sensitive data beyond what their role should permit, potentially exposing system configuration, credentials, or other confidential information.

Technologies: Supermicro BMC Firmware. Vendors: Supermicro.

Quick answers

Is CVE-2026-65210 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65210 being exploited in the wild.
How severe is CVE-2026-65210?: Medium severity, with a CVSS score of 4.9, published 27 October 2026.
Which products and versions are affected?: Supermicro BMC Firmware Multiple board models; see advisory for affected versions and fixes.
Is there a fix for CVE-2026-65210?: Yes: fixed in Varies by board model; examples include MBD-X13DEG-QT 01.08.16, MBD-X13SET-GC 01.08.16, MBD-X13SCL-F 01.14.01, MBD-X12SCA-F 01.16.01 (see advisory for complete list). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65210 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-65210?: Check whether you run Supermicro BMC Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Varies by board model; examples include MBD-X13DEG-QT 01.08.16, MBD-X13SET-GC 01.08.16, MBD-X13SCL-F 01.14.01, MBD-X12SCA-F 01.16.01 (see advisory for complete list)

Technical details

An arbitrary file read vulnerability in Supermicro BMC firmware allows an authenticated IPMI Administrator to access arbitrary files on the BMC filesystem via improper access controls. The vulnerability requires high-privilege IPMI authentication and network access (RMCP+ protocol). Exploitation discloses sensitive data outside the intended IPMI management scope.

Affected products

Supermicro BMC firmware Multiple board models; see advisory for affected versions and fixes

Timeline

2026-10-27: disclosed

References

https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.