{"id":"CVE-2026-18449","kind":"vulnerability","aliases":["CVE-2026-18449"],"related":[],"title":"BMC: IPMI commands run without integrity or encryption checks","description":"The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.","summary":"Supermicro BMCs with the optional SMCRAKP mode enabled use a fixed 20-byte key in place of the account password in the RAKP key exchange. A network attacker who knows an enabled username can complete the IPMI RMCP+ handshake without the password. On X14 the forged session cannot issue commands, but it still leaks a password-derived verification value. The NVD text describes the separate CVE-2026-18450 issue.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Supermicro BMC firmware (X10-X14, H13, H14, X11, X12)","fixed":["per board, see advisory"],"affected":"boards with SMCRAKP enabled, below the per-board fixed BMC firmware","ecosystem":"vendor"}],"ecosystems":[],"tags":["bmc","hardcoded-credentials","infrastructure","ipmi","out-of-band-management","rakp","servers","supermicro"],"not_affected_if":["bmc-not-network-exposed","default-config","ipmi-disabled","smcrakp-disabled"],"how_to_check":"Identify Supermicro board model and BMC firmware version (BMC web UI, or ipmitool mc info), compare with the fixed version for your board in the Supermicro advisory table. Then check whether SMCRAKP mode is enabled on the BMC; if it is off (the default), the issue is not reachable. Exact enable-state command unknown: not in the sources read.","fix":"Update BMC firmware to the board-specific fixed version in Supermicro's advisory security_BMC_IPMI_Oct_2026_1 (e.g. X13SEI-F 01.13.11, X12SPi-TF 01.07.27, X14SBI-F 01.07.22.00, X11 boards 01.74.26 / 03.75.35). X12DGU is TBD. Meanwhile, disable SMCRAKP mode and keep BMC/IPMI off untrusted networks.","status":"open","published_at":"2026-10-27T08:16:53+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","triaged_at":"2026-10-27T08:32:32+00:00","updated_at":"2026-10-27T08:33:55+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-27T08:32:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"BMC: IPMI commands run without integrity or encryption checks","impact":"high","summary":"The baseboard management controller does not enforce the integrity and encryption requirements on IPMI commands. An attacker can craft packets that execute arbitrary commands within an active session.","category":"infrastructure","nicknames":[],"who_cares":["bmc","ipmi","servers","out-of-band-management"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the BMC during an active session","analyst_note":"Find the affected BMC vendors and firmware versions and the fixed versions in the NVD entry and vendor advisories; the sources give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["ipmi-disabled","bmc-not-network-exposed"],"who_is_affected":"Servers and appliances whose BMC exposes IPMI over the network, where the BMC's management network is reachable by an attacker. Hosts with no BMC network exposure, or with IPMI disabled, are unlikely to be affected; the sources do not name the vendors or firmware versions involved.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00055,"input_tokens":3265,"output_tokens":447,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected BMC vendors and firmware versions and the fixed versions in the NVD entry and vendor advisories; the sources give neither.","search":"'-18449':12A,15A '-18450':108B '-2026':11A,14A,107B '20':51B 'abl':127C 'account':58B 'activ':137C 'arbitrari':133C 'attack':67B,124C 'band':35B 'bmc':1A,17A,26B,111C 'bmcs':41B 'byte':52B 'cannot':87B 'check':9A 'command':3A,89B,122C,134C 'complet':74B 'correct':114C 'craft':129C 'credenti':29B 'cve':10A,13A,106B 'deriv':97B 'describ':103B 'enabl':47B,71B 'encrypt':8A,118C 'enforc':115C 'exchang':64B 'execut':132C 'firmware':18A 'fix':50B 'forg':85B 'h13':22A 'h14':23A 'handshak':78B 'hardcod':28B 'hardcoded-credenti':27B 'infrastructur':30B 'integr':6A,116C 'ipmi':2A,31B,76B,121C 'issu':88B,109B 'key':53B,63B 'know':69B 'leak':93B 'manag':36B 'may':125C 'mode':46B 'network':66B 'nvd':101B 'option':44B 'out-of-band-manag':32B 'packet':130C 'password':59B,81B,96B 'password-deriv':95B 'place':55B 'rakp':37B,62B 'requir':119C 'rmcp':77B 'run':4A 'separ':105B 'server':38B 'session':86B,138C 'smcrakp':45B 'still':92B 'supermicro':16A,39B,40B 'text':102B 'use':48B 'usernam':72B 'valu':99B 'verif':98B 'without':5A,79B 'x10':20A 'x10-x14':19A 'x11':24A 'x12':25A 'x14':21A,83B","nicknames":[],"mitigations":[],"who_affected":"Servers and appliances whose BMC exposes IPMI over the network, where the BMC's management network is reachable by an attacker. Hosts with no BMC network exposure, or with IPMI disabled, are unlikely to be affected; the sources do not name the vendors or firmware versions involved.","tier":"B","verified":{"fix":{"at":"2026-10-27T08:33:55Z","by":"analyst","run_id":860}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T08:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"def9a96e-e099-41a9-bfac-30fd4f82c411","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18449","severity":null,"published_at":"2026-10-27T08:16:53+00:00","modified_at":"2026-10-27T08:16:53+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","fetched_at":"2026-10-27T08:31:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-18449:860","url":null,"severity":null,"published_at":"2026-10-27T08:33:55+00:00","modified_at":"2026-10-27T08:33:55+00:00","first_seen_at":"2026-10-27T08:33:55+00:00","fetched_at":"2026-10-27T08:33:55+00:00","note":"Supermicro advisory (Oct 26 2026) lists CVE-2026-18449 as SMCRAKP Fixed Key (hardcoded RAKP key, CWE-798, 7.5), NOT the integrity/encryption bug; NVD/signal description is copied from CVE-2026-18450 (Critical 9.8 per Supermicro, 8.1 per runZero) and is wrong for this id. Fixed BMC firmware is per board in vendor table; page read was truncated, X12/X13/X14 rows seen, some TBD (X12DGU). runZero says mode is off by default. No exploitation or public PoC link found; runZero gives the constant and repro steps."}],"documents":[{"id":5730,"url":"https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1","title":"Supermicro: Vulnerabilities in BMC firmware, October 26, 2026 (1)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":5731,"url":"https://www.runzero.com/advisories/smc-rakp-key-cve-2026-18449/","title":"runZero: Supermicro BMC Hardcoded RAKP Key","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":5732,"url":"https://www.runzero.com/advisories/smc-ipmi-auth-bypass-cve-2026-18450/","title":"runZero: Supermicro BMC Unauthenticated IPMI Commands (CVE-2026-18450)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}