Live › vulnerability › CVE-2026-18449
Go to dashboardSupermicro BMCs with the optional SMCRAKP mode enabled use a fixed 20-byte key in place of the account password in the RAKP key exchange. A network attacker who knows an enabled username can complete the IPMI RMCP+ handshake without the password. On X14 the forged session cannot issue commands, but it still leaks a password-derived verification value. The NVD text describes the separate CVE-2026-18450 issue.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 08:31 UTC. All times on this page are UTC.
Servers and appliances whose BMC exposes IPMI over the network, where the BMC's management network is reachable by an attacker. Hosts with no BMC network exposure, or with IPMI disabled, are unlikely to be affected; the sources do not name the vendors or firmware versions involved.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Supermicro BMC firmware (X10-X14, H13, H14, X11, X12) | vendor | boards with SMCRAKP enabled, below the per-board fixed BMC firmware | per board, see advisory |
01.13.11, X12SPi-TF 01.07.27, X14SBI-F 01.07.22.00, X11 boards 01.74.26 / 03.75.35)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
This page as .md · .json · in your agent: get_signal("CVE-2026-18449")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.