CVE-2026-18449: Supermicro BMC contains a SMCRAKP Fixed Key vulnerability
Published Oct 27, 2026
·Updated
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
Affected Software
1 affected component
Supermicro BMC
Event History
Oct 27, 2026
CVE Published
via MITRE·07:32 AM
Data Sourced
via MITRE·07:32 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The reported vector is network-based and requires no privileges or user interaction. Exploitation involves crafting IPMI packets against an active session.
2
What could a successful attacker do?
An attacker may be able to execute arbitrary commands on an active BMC IPMI session. The assigned vector indicates high confidentiality impact, with no reported integrity or availability impact.
3
Which configurations are affected?
The available information identifies Supermicro BMC systems but does not specify affected models, firmware versions, or whether the vulnerable IPMI behavior is enabled by default.