Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability (SMCI X12SPI)

CVE-2026-18450

CRITICAL 9.8

At a glance

Source: NVD
EPSS: EPSS 0.40 % · percentile 34 (2026-10-29)
State: PUBLISHED
Published: 2026-10-27 07:46 UTC
Updated: 2026-10-27 07:46 UTC
Assigner: Supermicro
NVD status: Awaiting Analysis

Description

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

Weaknesses (CWE)

CWE-306 — Missing Authentication for Critical Functionality

References

https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Supermicro
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · def9a96e-e099-41a9-bfac-30fd4f82c411 (Secondary)

European references

ENISA EUVD · EUVD-2026-110633
GCVE · GCVE-0-2026-18450

Affected products

Product	Versions
SMCI · X12SPI	affected 01.07.20

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD