---
id: "CVE-2026-18449"
kind: "vulnerability"
aliases: ["CVE-2026-18449"]
title: "BMC: IPMI commands run without integrity or encryption checks"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Supermicro BMC firmware (X10-X14, H13, H14, X11, X12)", "fixed": ["per board, see advisory"], "affected": "boards with SMCRAKP enabled, below the per-board fixed BMC firmware", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bmc", "hardcoded-credentials", "infrastructure", "ipmi", "out-of-band-management", "rakp", "servers", "supermicro"]
not_affected_if: ["bmc-not-network-exposed", "default-config", "ipmi-disabled", "smcrakp-disabled"]
published_at: "2026-10-27T08:16:53+00:00"
first_seen_at: "2026-10-27T08:31:47+00:00"
updated_at: "2026-10-27T08:33:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18449", "first_seen_at": "2026-10-27T08:31:47+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T08:33:55+00:00"}]
---

# BMC: IPMI commands run without integrity or encryption checks

Supermicro BMCs with the optional SMCRAKP mode enabled use a fixed 20-byte key in place of the account password in the RAKP key exchange. A network attacker who knows an enabled username can complete the IPMI RMCP+ handshake without the password. On X14 the forged session cannot issue commands, but it still leaks a password-derived verification value. The NVD text describes the separate CVE-2026-18450 issue.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Supermicro BMC firmware (X10-X14, H13, H14, X11, X12) affected boards with SMCRAKP enabled, below the per-board fixed BMC firmware fixed per board, see advisory

## How to check

Identify Supermicro board model and BMC firmware version (BMC web UI, or ipmitool mc info), compare with the fixed version for your board in the Supermicro advisory table. Then check whether SMCRAKP mode is enabled on the BMC; if it is off (the default), the issue is not reachable. Exact enable-state command unknown: not in the sources read.

## Fix

Update BMC firmware to the board-specific fixed version in Supermicro's advisory security_BMC_IPMI_Oct_2026_1 (e.g. X13SEI-F 01.13.11, X12SPi-TF 01.07.27, X14SBI-F 01.07.22.00, X11 boards 01.74.26 / 03.75.35). X12DGU is TBD. Meanwhile, disable SMCRAKP mode and keep BMC/IPMI off untrusted networks.

## Timeline

- 2026-10-27T08:31:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-18449
- 2026-10-27T08:33:55+00:00 analyst — Supermicro advisory (Oct 26 2026) lists CVE-2026-18449 as SMCRAKP Fixed Key (hardcoded RAKP key, CWE-798, 7.5), NOT the integrity/encryption bug; NVD/signal description is copied from CVE-2026-18450 (Critical 9.8 per Supermicro, 8.1 per runZero) and is wrong for this id. Fixed BMC firmware is per board in vendor table; page read was truncated, X12/X13/X14 rows seen, some TBD (X12DGU). runZero says mode is off by default. No exploitation or public PoC link found; runZero gives the constant and repro steps.

## Documents

- [advisory] Supermicro: Vulnerabilities in BMC firmware, October 26, 2026 (1) https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1
- [describes] runZero: Supermicro BMC Hardcoded RAKP Key https://www.runzero.com/advisories/smc-rakp-key-cve-2026-18449/
- [mentions] runZero: Supermicro BMC Unauthenticated IPMI Commands (CVE-2026-18450) https://www.runzero.com/advisories/smc-ipmi-auth-bypass-cve-2026-18450/

## From the sources

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_