# CVE-2026-65219: Supermicro BMC RAKP+ unordered message authentication bypass

Source: https://junglewise.ai/threats/cve-2026-65219-a-flaw-in-the-bmc-rakp-implementation-may-allow-an-attacker-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-65219 · Severity: high · CVSS 7.4 · Published 2026-10-27

Supermicro's Baseboard Management Controller (BMC) is a critical remote management interface for servers. A flaw in its RAKP+ authentication protocol allows attackers to bypass authentication by sending specially crafted messages, potentially gaining remote command execution on the server without proper credentials.

Technologies: [Supermicro BMC Firmware](https://junglewise.ai/threats/technologies/bmc-firmware). Vendors: [Supermicro](https://junglewise.ai/threats/vendors/supermicro).

## Quick answers

**Is CVE-2026-65219 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65219 being exploited in the wild.

**How severe is CVE-2026-65219?** High severity, with a CVSS score of 7.4, published 27 October 2026.

**Which products and versions are affected?** Supermicro BMC Firmware Multiple X13, H13, H14, H12, X12 motherboards; see fixed_in for affected models and patch versions.

**Is there a fix for CVE-2026-65219?** Yes: fixed in Varies by motherboard model; examples: MBD-X13DEG-QT 01.08.16, MBD-X13DEG-R 01.13.11, MBD-X13DDW-A 01.13.09, MBD-H14SSL-N 01.07.05.05, MBD-X12SPZ-SPLN6F 01.15.06, MBD-X12SCA-F 01.16.01. Consult Supermicro advisory for complete list of boards and versions.. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65219 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-65219?** Check whether you run Supermicro BMC Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Varies by motherboard model; examples: MBD-X13DEG-QT 01.08.16, MBD-X13DEG-R 01.13.11, MBD-X13DDW-A 01.13.09, MBD-H14SSL-N 01.07.05.05, MBD-X12SPZ-SPLN6F 01.15.06, MBD-X12SCA-F 01.16.01. Consult Supermicro advisory for complete list of boards and versions.

## Technical details

The BMC RAKP+ implementation fails to properly validate the ordering of RAKP message 3, allowing an attacker to establish an RMCP+ session without completing full authentication. This is a protocol-level bypass affecting the remote IPMI management interface, exploitable over the network with no user interaction required.

## Affected products

- Supermicro BMC Firmware Multiple X13, H13, H14, H12, X12 motherboards; see fixed_in for affected models and patch versions

## Timeline

- 2026-10-27: disclosed

## References

- [https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1](https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1)

## Related threats

- [Supermicro BMC firmware arbitrary memory access and code execution](https://junglewise.ai/threats/cve-2026-65211-this-issue-may-allow-an-authenticated-ipmi-administrator-to-read)
- [Supermicro BMC IPMI privilege escalation via RAKP+ messages](https://junglewise.ai/threats/cve-2026-65220-a-logic-flaw-in-the-bmc-ipmi-implementation-may-allow-an-attacker)
- [Supermicro BMC firmware arbitrary file access](https://junglewise.ai/threats/cve-2026-65210-this-issue-may-allow-an-authenticated-ipmi-administrator-to-read)
- [Supermicro BMC unprotected IPMI commands on active RMCP+ sessions](https://junglewise.ai/threats/cve-2026-18450-the-bmc-does-not-correctly-enforce-integrity-and-encryption)
- [Supermicro BMC SMCRAKP hardcoded key vulnerability](https://junglewise.ai/threats/cve-2026-18449-the-bmc-does-not-correctly-enforce-integrity-and-encryption)