CVE-2026-65211: Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability
Published Oct 27, 2026
·Updated
This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.
Affected Software
1 affected component
Supermicro BMC IPMI
Event History
Oct 27, 2026
CVE Published
via MITRE·08:12 AM
Data Sourced
via MITRE·08:12 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is able to exploit this issue?
An authenticated IPMI Administrator is required. The provided information does not indicate that unauthenticated users or lower-privileged IPMI accounts can exploit it.
2
What access does successful exploitation provide?
An attacker can read and write arbitrary BMC physical memory and may execute code on the BMC operating system. This can compromise the confidentiality, integrity, and availability of the BMC.
3
Is this exploitable remotely?
The vector is network-based (AV:N), so exploitation can occur over a reachable network connection. An attacker still needs authenticated IPMI Administrator privileges.