{"id":"CVE-2026-65219","kind":"vulnerability","aliases":["CVE-2026-65219"],"related":[],"title":"BMC RAKP+ flaw lets attackers open sessions and run commands","description":"A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.","summary":"Supermicro ATEN BMC firmware accepts RAKP Message 3 without a prior RAKP Message 1. An unauthenticated attacker who can reach UDP/623 can open an IPMI session using the stored key of user record 0 (a one-character or empty password on observed X11DPT-PS and H13 units, or a constant compiled into the firmware when SMCRAKP is enabled). runZero found the session is restricted: Serial-over-LAN and the host serial console work, but the full administrative IPMI command set does not. X14 (tested on 01.06.07) is not affected.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Supermicro BMC firmware (ATEN)","fixed":["X11DPT-PS 01.74.26","X13DEI 01.09.15","H13SSL-N 01.09.08"],"affected":"per-board versions below the fixed version in the Supermicro advisory","ecosystem":"vendor"}],"ecosystems":[],"tags":["aten","bmc","data-center","h13","infrastructure","ipmi","rmcp","servers","sol","supermicro","udp-623","x11","x12","x13"],"not_affected_if":["bmc-network-isolated","ipmi-over-lan-disabled","no-bmc","non-supermicro","supermicro-x14"],"how_to_check":"Identify Supermicro boards with ATEN BMC (X11, X12, X13, H12, H13; runZero observed X11DPT-PS 01.74 and H13) and compare the BMC firmware version with the fixed version for your board in the Supermicro advisory table. Check whether UDP/623 (IPMI over LAN) is reachable from untrusted networks, for example nmap -sU -p 623 <bmc-ip>. runZero found X14 5601MS 01.06.07 not vulnerable.","fix":"Update the BMC firmware to the fixed version listed for your board in the Supermicro advisory (examples: X11DPT-PS 01.74.26, X13DEI 01.09.15, H13SSL-N 01.09.08, X14SBI-F 01.07.22.00). X12DGU is listed as TBD. Until patched, block UDP/623 and keep the BMC on an isolated management network. Do not rely on setting a password on user record 0: the firmware refuses writes to it.","status":"open","published_at":"2026-10-27T08:16:54+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","triaged_at":"2026-10-27T08:32:33+00:00","updated_at":"2026-10-27T08:33:59+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-27T08:32:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"BMC RAKP+ flaw lets attackers open sessions and run commands","impact":"high","summary":"A flaw in the baseboard management controller's RAKP+ authentication lets an attacker send a crafted RAKP message and establish an RMCP+ session. The attacker can then execute commands on the management controller.","category":"infrastructure","nicknames":[],"who_cares":["bmc","ipmi","servers","data-center"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker runs commands on the server's management controller","analyst_note":"Check the NVD entry and the vendor advisories for affected BMC firmware versions and patches.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-bmc","bmc-network-isolated"],"who_is_affected":"Teams that run servers with a baseboard management controller (BMC) reachable over IPMI/RMCP+ on the network are likely in scope. Hosts with no BMC, or with the BMC network interface disabled or isolated, are unlikely to be exposed. The sources do not name affected vendors or firmware versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000548,"input_tokens":3288,"output_tokens":439,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor advisories for affected BMC firmware versions and patches.","search":"'-2026':12A,15A '-623':34B '-65219':13A,16A '0':71B '01.06.07':126B '1':51B '3':45B 'accept':42B 'administr':117B 'affect':129B 'allow':138C 'aten':20A,21B,39B 'attack':5A,54B,140C 'bmc':1A,18A,22B,40B,134C 'center':25B 'charact':75B 'command':10A,119B,164C 'compil':90B 'consol':112B 'constant':89B 'could':158C 'craft':149C 'cve':11A,14A 'data':24B 'data-cent':23B 'empti':77B 'enabl':97B 'establish':153C 'execut':163C 'firmwar':41B,93B 'firmware':19A 'flaw':3A,131C 'follow':145C 'found':99B 'full':116B 'h13':26B,85B 'host':110B 'implement':136C 'infrastructur':27B 'ipmi':28B,62B,118B 'key':67B 'lan':107B 'let':4A 'may':137C 'messag':44B,50B,151C 'observ':80B 'one':74B 'one-charact':73B 'open':6A,60B 'password':78B 'prior':48B 'ps':83B 'rakp':2A,43B,49B,135C,150C 'reach':57B 'record':70B 'request':144C 'restrict':103B 'rmcp':29B,155C 'run':9A 'runzero':98B 'send':142C 'serial':105B,111B 'serial-over-lan':104B 'server':30B 'session':7A,63B,101B,156C 'set':120B 'smcrakp':95B 'sol':31B 'special':148C 'store':66B 'supermicro':17A,32B,38B 'test':124B 'udp':33B 'udp/623':58B 'unauthent':53B 'unit':86B 'use':64B,161C 'user':69B 'without':46B 'work':113B 'x11':35B 'x11dpt':82B 'x11dpt-ps':81B 'x12':36B 'x13':37B 'x14':123B","nicknames":[],"mitigations":[],"who_affected":"Teams that run servers with a baseboard management controller (BMC) reachable over IPMI/RMCP+ on the network are likely in scope. Hosts with no BMC, or with the BMC network interface disabled or isolated, are unlikely to be exposed. The sources do not name affected vendors or firmware versions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T08:16:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"def9a96e-e099-41a9-bfac-30fd4f82c411","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65219","severity":null,"published_at":"2026-10-27T08:16:54+00:00","modified_at":"2026-10-27T08:16:54+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","fetched_at":"2026-10-27T08:31:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-65219:859","url":null,"severity":null,"published_at":"2026-10-27T08:33:59+00:00","modified_at":"2026-10-27T08:33:59+00:00","first_seen_at":"2026-10-27T08:33:59+00:00","fetched_at":"2026-10-27T08:33:59+00:00","note":"Supermicro advisory (Oct 26 2026) + runZero writeup read. Supermicro ATEN BMC only; impact narrower than title: SOL/serial console, not full IPMI command set. No exploitation or public PoC tool seen (runZero shows packet walkthrough). Fixed versions are per board in Supermicro table (shared with 7 other CVEs, table truncated in my fetch). Nothing marked verified; social search not done."}],"documents":[{"id":5730,"url":"https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1","title":"Supermicro: Vulnerabilities in BMC firmware, October 26, 2026 (1)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":5734,"url":"https://www.runzero.com/advisories/smc-rakp-bypass-cve-2026-65219/","title":"runZero: Supermicro ATEN RAKP Authentication Bypass","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}