{"id":"CVE-2026-65211","kind":"vulnerability","aliases":["CVE-2026-65211"],"related":[],"title":"BMC firmware: IPMI administrator can write physical memory and run code","description":"This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.","summary":"An attacker holding IPMI Administrator credentials can read and write arbitrary physical memory on the baseboard management controller. That lets them execute code on the BMC operating system.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bare-metal","bmc","infrastructure","ipmi","self-hosted"],"not_affected_if":["ipmi-disabled","no-bmc"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T09:16:33+00:00","first_seen_at":"2026-10-27T09:30:50+00:00","triaged_at":"2026-10-27T09:32:51+00:00","updated_at":"2026-10-27T09:32:51+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T09:32:51Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"BMC firmware: IPMI administrator can write physical memory and run code","impact":"high","summary":"An attacker holding IPMI Administrator credentials can read and write arbitrary physical memory on the baseboard management controller. That lets them execute code on the BMC operating system.","category":"infrastructure","nicknames":[],"who_cares":["self-hosted","bare-metal","ipmi","bmc"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker runs code on the BMC operating system","analyst_note":"Find the vendor advisory and affected BMC firmware versions and the fixed build; the NVD entry alone names no product or version.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-bmc","ipmi-disabled"],"who_is_affected":"Teams that run servers with a baseboard management controller reachable over IPMI. Only systems where an IPMI Administrator account exists are exposed, and the sources do not name the affected BMC vendor or firmware versions. Hosts with no BMC or with IPMI disabled can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000544,"input_tokens":3270,"output_tokens":434,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65211':14A,17A 'administr':4A,31B,62C 'allow':58C 'arbitrari':37B,67C 'attack':28B 'authent':60C 'bare':19B 'bare-met':18B 'baseboard':42B 'bmc':1A,21B,52B,68C,77C 'code':11A,49B,74C 'control':44B 'credenti':32B 'cve':12A,15A 'execut':48B,73C 'firmwar':2A 'hold':29B 'host':26B 'infrastructur':22B 'ipmi':3A,23B,30B,61C 'issu':56C 'let':46B 'manag':43B 'may':57C 'memori':8A,39B,70C 'metal':20B 'oper':53B,78C 'physic':7A,38B,69C 'read':34B,64C 'run':10A 'self':25B 'self-host':24B 'system':54B,79C 'therebi':72C 'write':6A,36B,66C","nicknames":[],"mitigations":[],"who_affected":"Teams that run servers with a baseboard management controller reachable over IPMI. Only systems where an IPMI Administrator account exists are exposed, and the sources do not name the affected BMC vendor or firmware versions. Hosts with no BMC or with IPMI disabled can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T09:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"def9a96e-e099-41a9-bfac-30fd4f82c411","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65211","severity":null,"published_at":"2026-10-27T09:16:33+00:00","modified_at":"2026-10-27T09:16:33+00:00","first_seen_at":"2026-10-27T09:30:50+00:00","fetched_at":"2026-10-27T09:30:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}