CVE-2026-18450

Full vulnerability record from the local CVENow database.

Description

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

Severity

CRITICAL

CVSS score

9.8 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

def9a96e-e099-41a9-bfac-30fd4f82c411

Published

2026-10-27 08:16:53.710000

Last modified

2026-10-27 15:54:05.340000

View original CVE JSON

{
  "id": "CVE-2026-18450",
  "sourceIdentifier": "def9a96e-e099-41a9-bfac-30fd4f82c411",
  "published": "2026-10-27T08:16:53.710",
  "lastModified": "2026-10-27T15:54:05.340",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
    }
  ],
  "affected": [
    {
      "source": "def9a96e-e099-41a9-bfac-30fd4f82c411",
      "affectedData": [
        {
          "vendor": "SMCI",
          "product": "X12SPI",
          "defaultStatus": "unaffected",
          "platforms": [
            "BMC"
          ],
          "versions": [
            {
              "version": "01.07.20",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "def9a96e-e099-41a9-bfac-30fd4f82c411",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "def9a96e-e099-41a9-bfac-30fd4f82c411",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1",
      "source": "def9a96e-e099-41a9-bfac-30fd4f82c411"
    }
  ]
}