---
id: "CVE-2026-65219"
kind: "vulnerability"
aliases: ["CVE-2026-65219"]
title: "BMC RAKP+ flaw lets attackers open sessions and run commands"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Supermicro BMC firmware (ATEN)", "fixed": ["X11DPT-PS 01.74.26", "X13DEI 01.09.15", "H13SSL-N 01.09.08"], "affected": "per-board versions below the fixed version in the Supermicro advisory", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aten", "bmc", "data-center", "h13", "infrastructure", "ipmi", "rmcp", "servers", "sol", "supermicro", "udp-623", "x11", "x12", "x13"]
not_affected_if: ["bmc-network-isolated", "ipmi-over-lan-disabled", "no-bmc", "non-supermicro", "supermicro-x14"]
published_at: "2026-10-27T08:16:54+00:00"
first_seen_at: "2026-10-27T08:31:47+00:00"
updated_at: "2026-10-27T08:33:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65219", "first_seen_at": "2026-10-27T08:31:47+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T08:33:59+00:00"}]
---

# BMC RAKP+ flaw lets attackers open sessions and run commands

Supermicro ATEN BMC firmware accepts RAKP Message 3 without a prior RAKP Message 1. An unauthenticated attacker who can reach UDP/623 can open an IPMI session using the stored key of user record 0 (a one-character or empty password on observed X11DPT-PS and H13 units, or a constant compiled into the firmware when SMCRAKP is enabled). runZero found the session is restricted: Serial-over-LAN and the host serial console work, but the full administrative IPMI command set does not. X14 (tested on 01.06.07) is not affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Supermicro BMC firmware (ATEN) affected per-board versions below the fixed version in the Supermicro advisory fixed X11DPT-PS 01.74.26, X13DEI 01.09.15, H13SSL-N 01.09.08

## How to check

Identify Supermicro boards with ATEN BMC (X11, X12, X13, H12, H13; runZero observed X11DPT-PS 01.74 and H13) and compare the BMC firmware version with the fixed version for your board in the Supermicro advisory table. Check whether UDP/623 (IPMI over LAN) is reachable from untrusted networks, for example nmap -sU -p 623 <bmc-ip>. runZero found X14 5601MS 01.06.07 not vulnerable.

## Fix

Update the BMC firmware to the fixed version listed for your board in the Supermicro advisory (examples: X11DPT-PS 01.74.26, X13DEI 01.09.15, H13SSL-N 01.09.08, X14SBI-F 01.07.22.00). X12DGU is listed as TBD. Until patched, block UDP/623 and keep the BMC on an isolated management network. Do not rely on setting a password on user record 0: the firmware refuses writes to it.

## Timeline

- 2026-10-27T08:31:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65219
- 2026-10-27T08:33:59+00:00 analyst — Supermicro advisory (Oct 26 2026) + runZero writeup read. Supermicro ATEN BMC only; impact narrower than title: SOL/serial console, not full IPMI command set. No exploitation or public PoC tool seen (runZero shows packet walkthrough). Fixed versions are per board in Supermicro table (shared with 7 other CVEs, table truncated in my fetch). Nothing marked verified; social search not done.

## Documents

- [advisory] Supermicro: Vulnerabilities in BMC firmware, October 26, 2026 (1) https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1
- [describes] runZero: Supermicro ATEN RAKP Authentication Bypass https://www.runzero.com/advisories/smc-rakp-bypass-cve-2026-65219/

## From the sources

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_