CVE-2026-18450
CriticalPublished
Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability
- Published
- Oct 27, 2026
- Updated
- Oct 27, 2026
- Assigning CNA
- Supermicro
- Evidence observed
- Sep 27, 2026
Primary CVSS
9.8/ 10Critical
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
Sources
Exploit-Index : The Ultimate CVE Proof of Concept (PoC) & Exploit Database. A zero-API, high-performance aggregator for 0days, vulnerabilities, and Threat Intelligence. Replacing manual searches for elite SOC teams, DevSecOps, and Bug Bounty Hunters.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.