CVE-2026-18451: Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token
Published Oct 27, 2026
·Updated
The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.
Affected Software
1 affected component
Supermicro BMC iKVM
Event History
Oct 27, 2026
CVE Published
via MITRE·07:51 AM
Data Sourced
via MITRE·07:51 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does an attacker need valid BMC credentials to exploit this issue?
No. The CVSS vector lists privileges required as none (PR:N), although it also indicates user interaction is required (UI:R).
2
Which deployments are most exposed?
Deployments where the Supermicro BMC HTML5 KVM-over-IP web interface is reachable by an attacker are relevant. The issue concerns the token used to authenticate access to the KVM console.