Live › vulnerability › CVE-2026-65219
Go to dashboardSupermicro ATEN BMC firmware accepts RAKP Message 3 without a prior RAKP Message 1. An unauthenticated attacker who can reach UDP/623 can open an IPMI session using the stored key of user record 0 (a one-character or empty password on observed X11DPT-PS and H13 units, or a constant compiled into the firmware when SMCRAKP is enabled). runZero found the session is restricted: Serial-over-LAN and the host serial console work, but the full administrative IPMI command set does not. X14 (tested on 01.06.07) is not affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 08:31 UTC. All times on this page are UTC.
Teams that run servers with a baseboard management controller (BMC) reachable over IPMI/RMCP+ on the network are likely in scope. Hosts with no BMC, or with the BMC network interface disabled or isolated, are unlikely to be exposed. The sources do not name affected vendors or firmware versions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Supermicro BMC firmware (ATEN) | vendor | per-board versions below the fixed version in the Supermicro advisory | X11DPT-PS 01.74.26, X13DEI 01.09.15, H13SSL-N 01.09.08 |
01.06.07 not vulnerable01.74.26, X13DEI 01.09.15, H13SSL-N 01.09.08, X14SBI-F 01.07.22.00)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.
This page as .md · .json · in your agent: get_signal("CVE-2026-65219")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.