CVE-2026-16521: Supermicro BMC's syslog feature contains a command injection vulnerability
Published Oct 27, 2026
·Updated
An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted.
Affected Software
1 affected component
Supermicro BMC
Event History
Oct 27, 2026
CVE Published
via MITRE·07:22 AM
Data Sourced
via MITRE·07:22 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need?
The attack vector is network-based, but the CVSS vector indicates high privileges are required. No user interaction is required.
2
When would a malicious payload run?
A payload injected into the affected BMC function may execute when the related service is restarted.