{"id":"CVE-2026-18450","kind":"vulnerability","aliases":["CVE-2026-18450"],"related":[],"title":"BMC: IPMI commands run without integrity or encryption checks","description":"The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.","summary":"The BMC, the out-of-band management controller on a server, does not enforce integrity and encryption requirements on IPMI commands. A crafted packet can run arbitrary commands within an active session.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bmc","infrastructure","ipmi","self-hosted","servers"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T08:16:53+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","triaged_at":"2026-10-27T08:32:28+00:00","updated_at":"2026-10-27T08:32:28+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T08:32:28Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"BMC: IPMI commands run without integrity or encryption checks","impact":"high","summary":"The BMC, the out-of-band management controller on a server, does not enforce integrity and encryption requirements on IPMI commands. A crafted packet can run arbitrary commands within an active session.","category":"infrastructure","nicknames":[],"who_cares":["bmc","ipmi","servers","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the server through the management controller","analyst_note":"Find the vendor advisory and affected BMC firmware versions, and whether the attack needs an active session or only network access to IPMI port 623; NVD link is the only source given.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running servers with a baseboard management controller that exposes IPMI on the network. The sources do not name vendors, firmware versions or whether the issue needs an existing session, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000533,"input_tokens":3266,"output_tokens":413,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-18450':12A,15A '-2026':11A,14A 'abl':73C 'activ':54B,83C 'arbitrari':50B,79C 'attack':70C 'band':29B 'bmc':1A,16B,24B,57C 'check':9A 'command':3A,44B,51B,68C,80C 'control':31B 'correct':60C 'craft':46B,75C 'cve':10A,13A 'encrypt':8A,40B,64C 'enforc':37B,61C 'execut':78C 'host':21B 'infrastructur':17B 'integr':6A,38B,62C 'ipmi':2A,18B,43B,67C 'manag':30B 'may':71C 'out-of-band':26B 'packet':47B,76C 'requir':41B,65C 'run':4A,49B 'self':20B 'self-host':19B 'server':22B,34B 'session':55B,84C 'within':52B 'without':5A","nicknames":[],"mitigations":[],"who_affected":"Teams running servers with a baseboard management controller that exposes IPMI on the network. The sources do not name vendors, firmware versions or whether the issue needs an existing session, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T08:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"def9a96e-e099-41a9-bfac-30fd4f82c411","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18450","severity":null,"published_at":"2026-10-27T08:16:53+00:00","modified_at":"2026-10-27T08:16:53+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","fetched_at":"2026-10-27T08:31:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}