{"id":"CVE-2026-65220","kind":"vulnerability","aliases":["CVE-2026-65220"],"related":[],"title":"BMC IPMI: crafted RAKP+ messages can escalate an account to administrator","description":"A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.","summary":"A logic flaw in the BMC IPMI implementation lets an attacker send specially crafted RAKP+ messages during authentication. The sources say this can escalate an account to administrator privileges on the baseboard management controller.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bmc","data-center","infrastructure","ipmi","servers"],"not_affected_if":["ipmi-disabled","no-bmc"],"how_to_check":"- Identify BMC or IPMI interfaces on servers and appliances, for example with `ipmitool lan print` from the host or an inventory of management network addresses.\n- Check the BMC firmware version against the vendor advisory, which the sources do not name.\n- unknown: the sources do not say which BMC vendors or firmware builds are affected.","fix":"- Update BMC firmware to the vendor's patched release; the fixed version is unknown from the sources.\n- Restrict IPMI/BMC network access to a dedicated management network and disable IPMI over LAN where it is not needed.\n- Rotate BMC account passwords after patching if administrator escalation may have occurred.","status":"open","published_at":"2026-10-27T08:16:54+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","triaged_at":"2026-10-27T08:32:29+00:00","updated_at":"2026-10-27T08:32:29+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T08:32:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update BMC firmware to the vendor's patched release; the fixed version is unknown from the sources.\n- Restrict IPMI/BMC network access to a dedicated management network and disable IPMI over LAN where it is not needed.\n- Rotate BMC account passwords after patching if administrator escalation may have occurred.","reach":"network","title":"BMC IPMI: crafted RAKP+ messages can escalate an account to administrator","impact":"high","summary":"A logic flaw in the BMC IPMI implementation lets an attacker send specially crafted RAKP+ messages during authentication. The sources say this can escalate an account to administrator privileges on the baseboard management controller.","category":"infrastructure","nicknames":[],"who_cares":["ipmi","bmc","servers","data-center"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker gains administrator control of the BMC","analyst_note":"Find the vendor advisory and affected firmware versions for the BMC implementation; the NVD entry alone gives no product or fixed version.","how_to_check":"- Identify BMC or IPMI interfaces on servers and appliances, for example with `ipmitool lan print` from the host or an inventory of management network addresses.\n- Check the BMC firmware version against the vendor advisory, which the sources do not name.\n- unknown: the sources do not say which BMC vendors or firmware builds are affected.","needs_analyst":true,"not_affected_if":["no-bmc","ipmi-disabled"],"who_is_affected":"Teams that run servers or appliances with a BMC exposing IPMI over the network are affected. The sources do not say which vendors or firmware versions are vulnerable. Systems with no BMC or with IPMI disabled can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000651,"input_tokens":3275,"output_tokens":646,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65220':14A,17A 'account':9A,50B,80C 'administr':11A,52B,82C 'allow':68C 'attack':35B,70C 'authent':42B 'baseboard':56B 'bmc':1A,18B,30B,64C 'center':21B 'control':58B 'craft':3A,38B,74C 'cve':12A,15A 'data':20B 'data-cent':19B 'escal':7A,48B,78C 'flaw':27B,61C 'implement':32B,66C 'infrastructur':22B 'ipmi':2A,23B,31B,65C 'let':33B 'logic':26B,60C 'manag':57B 'may':67C 'messag':5A,40B,76C 'privileg':53B,83C 'rakp':4A,39B,75C 'say':45B 'send':36B,72C 'server':24B 'sourc':44B 'special':37B,73C","nicknames":[],"mitigations":[],"who_affected":"Teams that run servers or appliances with a BMC exposing IPMI over the network are affected. The sources do not say which vendors or firmware versions are vulnerable. Systems with no BMC or with IPMI disabled can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T08:16:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"def9a96e-e099-41a9-bfac-30fd4f82c411","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65220","severity":null,"published_at":"2026-10-27T08:16:54+00:00","modified_at":"2026-10-27T08:16:54+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","fetched_at":"2026-10-27T08:31:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}