# CVE-2026-65220: Supermicro BMC IPMI privilege escalation via RAKP+ messages

Source: https://junglewise.ai/threats/cve-2026-65220-a-logic-flaw-in-the-bmc-ipmi-implementation-may-allow-an-attacker  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-65220 · Severity: high · CVSS 8.8 · Published 2026-10-27

Supermicro's Baseboard Management Controller (BMC) is a system that manages server hardware remotely. A logic flaw in its IPMI implementation allows an attacker with low-level access to send specially crafted network messages and gain full administrator control of the BMC, enabling complete compromise of the server and data center infrastructure.

Technologies: [Supermicro BMC Firmware](https://junglewise.ai/threats/technologies/bmc-firmware). Vendors: [Supermicro](https://junglewise.ai/threats/vendors/supermicro).

## Quick answers

**Is CVE-2026-65220 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65220 being exploited in the wild.

**How severe is CVE-2026-65220?** High severity, with a CVSS score of 8.8, published 27 October 2026.

**Which products and versions are affected?** Supermicro BMC Firmware Multiple motherboard models; see advisory for specific fixed versions per model.

**Is there a fix for CVE-2026-65220?** Yes: fixed in Varies by motherboard model; see Supermicro advisory for model-specific firmware versions (e.g., MBD-X13DEG-QT 01.08.16, MBD-X13DEG-R 01.13.11, MBD-X13DDW-A 01.13.09, and many others). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65220 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-65220?** Check whether you run Supermicro BMC Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Varies by motherboard model; see Supermicro advisory for model-specific firmware versions (e.g., MBD-X13DEG-QT 01.08.16, MBD-X13DEG-R 01.13.11, MBD-X13DDW-A 01.13.09, and many others)

## Technical details

A logic flaw in the RAKP+ authentication protocol implementation of the Supermicro BMC allows privilege escalation from low-privileged IPMI user to administrator. An attacker with network access and initial IPMI credentials can send malformed RAKP+ messages to bypass authentication checks and escalate privileges. This requires low privilege credentials (PR:L) but no user interaction; exploitation grants full administrative access to the BMC.

## Affected products

- Supermicro BMC firmware Multiple motherboard models; see advisory for specific fixed versions per model

## Timeline

- 2026-10-27: disclosed

## References

- [https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1](https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1)

## Related threats

- [Supermicro BMC firmware arbitrary memory access and code execution](https://junglewise.ai/threats/cve-2026-65211-this-issue-may-allow-an-authenticated-ipmi-administrator-to-read)
- [Supermicro BMC RAKP+ unordered message authentication bypass](https://junglewise.ai/threats/cve-2026-65219-a-flaw-in-the-bmc-rakp-implementation-may-allow-an-attacker-to)
- [Supermicro BMC firmware arbitrary file access](https://junglewise.ai/threats/cve-2026-65210-this-issue-may-allow-an-authenticated-ipmi-administrator-to-read)
- [Supermicro BMC unprotected IPMI commands on active RMCP+ sessions](https://junglewise.ai/threats/cve-2026-18450-the-bmc-does-not-correctly-enforce-integrity-and-encryption)
- [Supermicro BMC SMCRAKP hardcoded key vulnerability](https://junglewise.ai/threats/cve-2026-18449-the-bmc-does-not-correctly-enforce-integrity-and-encryption)