CVE-2026-65213 PUBLISHED

Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability

Assigner: Supermicro
Reserved: 21.07.2026 Published: 27.10.2026 Updated: 27.10.2026

This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 6.6

Product Status

Vendor SMCI
Product MBD-X12SPI
Versions Default: affected
  • Version 01.07.20 is affected

Credits

  • runZero finder

References

Problem Types

  • CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') CWE

Impacts

  • CAPEC-88: OS Command Injection