CVE-2026-3821 PUBLISHED

Supermicro SMASH service contain an Arbitrary code execution issue

Assigner: Supermicro
Reserved: 09.03.2026 Published: 22.07.2026 Updated: 22.07.2026

Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	SMCI
Product	X14DBG-DAP,X14DBI
Versions	Default: unaffected Version 01.00.16.00 is affected Version 1.03.02.06 is affected

Credits

Anton Beidin and the research team at Eclypsium, Inc. finder

References

https://www.supermicro.com/en/support/security_BMC_IPMI_Jul_2026

Problem Types

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') CWE

Impacts

CAPEC-88 OS Command Injection