Supermicro fixes BMC flaws affecting 392 board models

Eight vulnerabilities have been disclosed affecting Supermicro baseboard management controllers (BMCs) across 392 motherboard and module SKUs, with the most severe IPMI flaw rated CVSSv3 9.8. The critical issue, CVE-2026-18450, allows an unauthenticated attacker to run IPMI commands on an active session. Researchers at runZero identified and reported all eight flaws, which affect IPMI and KVM features in Supermicro BMC firmware.

Four of the flaws are high or above in severity, with three able to be exploited without logging in. Supermicro has released fixed BMC firmware for most boards, and says it is not aware of any attacks to date.

The advisory lists 392 affected SKUs, spanning X11, X12, X13, and X14 Intel families, plus some AMD boards and chassis modules. CVE-2026-18450 is the standout with a 9.8 score; other notable entries include CVE-2026-65220 (CVSS 8.8), CVE-2026-18449 (7.5), CVE-2026-65219 (7.4), CVE-2026-65211 (7.2), CVE-2026-65213 (6.6), CVE-2026-65210 (4.9), and CVE-2026-18451 (3.1). Patches are to be applied via the latest Supermicro BMC IPMI security advisory (October 2026).

Until updates land, the guidance notes keeping BMC interfaces offline or on an isolated management network, rotating BMC passwords after patching, and that there have been no public proofs of exploitation and no KEV listing by CISA. Supermicro states all affected SKUs will require a BMC update to mitigate these vulnerabilities.