{"id":"CVE-2026-16521","kind":"vulnerability","aliases":["CVE-2026-16521"],"related":[],"title":"BMC firmware: insufficient input filtering lets injected OS commands run","description":"An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted.","summary":"An attacker can inject a command payload into a BMC function, a flaw caused by insufficient input filtering. The payload may execute when the related service is restarted.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bmc","infrastructure","self-hosted","servers"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T08:16:53+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","triaged_at":"2026-10-27T08:32:33+00:00","updated_at":"2026-10-27T08:32:33+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-27T08:32:33Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"BMC firmware: insufficient input filtering lets injected OS commands run","impact":"high","summary":"An attacker can inject a command payload into a BMC function, a flaw caused by insufficient input filtering. The payload may execute when the related service is restarted.","category":"infrastructure","nicknames":[],"who_cares":["bmc","servers","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Injected commands may run on the BMC when a service restarts","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-16521 for the vendor, affected BMC product and firmware versions, and the vendor advisory with the fixed version.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run servers with a baseboard management controller (BMC) exposed to a management network. The sources do not name the vendor, product or affected firmware versions, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000531,"input_tokens":3259,"output_tokens":411,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-16521':13A,16A '-2026':12A,15A 'attack':24B,63C 'bmc':1A,17B,32B,71C 'caus':36B 'command':9A,28B,53C,67C 'cve':11A,14A 'execut':44B,76C 'exist':56C 'filter':5A,40B,61C 'firmwar':2A 'flaw':35B 'function':33B,72C 'host':21B 'infrastructur':18B 'inject':7A,26B,54C,65C 'input':4A,39B,60C 'insuffici':3A,38B,59C 'let':6A 'may':43B,75C 'os':8A,52C 'payload':29B,42B,68C,74C 'relat':47B,79C 'restart':50B,82C 'run':10A 'self':20B 'self-host':19B 'server':22B 'servic':48B,80C 'vulner':55C","nicknames":[],"mitigations":[],"who_affected":"Teams that run servers with a baseboard management controller (BMC) exposed to a management network. The sources do not name the vendor, product or affected firmware versions, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T08:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"def9a96e-e099-41a9-bfac-30fd4f82c411","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16521","severity":null,"published_at":"2026-10-27T08:16:53+00:00","modified_at":"2026-10-27T08:16:53+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","fetched_at":"2026-10-27T08:31:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}