CVE-2026-65219

Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability

HIGH

7.4

CVSS Score

Published: October 27, 2026 at 07:57 AM UTC

Updated: October 27, 2026 at 03:54 PM UTC

1 product affected across 1 vendorMBD-X12SPI

Using MBD-X12SPI by SMCI?

Get instant alerts when new vulnerabilities affect MBD-X12SPI - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.4

Exploit prediction

EPSS 0.5%

Description

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

MBD-X12SPI · Smci

89%

1.07.20

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

Source: cverecord

https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1

CVSS

7.4HIGHSupermicro

Attack Vector: NETWORK
Complexity: HIGH
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: NONE

Vector?

Quick Info

StatusAWAITING ANALYSIS

CWE

CWE-696

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card