{"id":"CVE-2026-65213","kind":"vulnerability","aliases":["CVE-2026-65213"],"related":[],"title":"BMC firmware: IPMI administrator can run commands as root","description":"This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC","summary":"An IPMI-authenticated administrator can execute commands as root on the server's baseboard management controller (BMC). The sources do not name the affected vendor or firmware versions.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bmc","infrastructure","ipmi","self-hosted","servers"],"not_affected_if":["no-bmc","no-ipmi"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T09:16:34+00:00","first_seen_at":"2026-10-27T09:30:50+00:00","triaged_at":"2026-10-27T09:32:50+00:00","updated_at":"2026-10-27T09:32:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T09:32:50Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"BMC firmware: IPMI administrator can run commands as root","impact":"high","summary":"An IPMI-authenticated administrator can execute commands as root on the server's baseboard management controller (BMC). The sources do not name the affected vendor or firmware versions.","category":"infrastructure","nicknames":[],"who_cares":["bmc","ipmi","servers","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"Administrator on BMC gains root command execution on the management controller","analyst_note":"Identify the affected hardware vendor and firmware versions from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-65213) and the vendor advisory it references.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-ipmi","no-bmc"],"who_is_affected":"Teams that run servers with a baseboard management controller reachable over IPMI. Affected firmware is not named in the sources, so check the hardware vendor's advisory for your model. Systems without IPMI or BMC access exposed to administrators can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000545,"input_tokens":3247,"output_tokens":441,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-65213':12A,15A 'administr':4A,27B,59C 'affect':47B 'allow':55C 'authent':26B,58C 'baseboard':37B 'bmc':1A,16B,40B,71C 'command':7A,30B,62C 'control':39B 'cve':10A,13A 'execut':29B,61C 'firmwar':2A,50B 'host':21B 'infrastructur':17B 'ipmi':3A,18B,25B,57C 'ipmi-authent':24B 'issu':53C 'manag':38B 'may':54C 'name':45B 'oper':65C 'root':9A,32B,67C 'run':6A 'self':20B 'self-host':19B 'server':22B,35B 'sourc':42B 'system':66C 'user':68C 'vendor':48B 'version':51B","nicknames":[],"mitigations":[],"who_affected":"Teams that run servers with a baseboard management controller reachable over IPMI. Affected firmware is not named in the sources, so check the hardware vendor's advisory for your model. Systems without IPMI or BMC access exposed to administrators can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T09:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"def9a96e-e099-41a9-bfac-30fd4f82c411","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65213","severity":null,"published_at":"2026-10-27T09:16:34+00:00","modified_at":"2026-10-27T09:16:34+00:00","first_seen_at":"2026-10-27T09:30:50+00:00","fetched_at":"2026-10-27T09:30:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}