---
id: "CVE-2026-65220"
kind: "vulnerability"
aliases: ["CVE-2026-65220"]
title: "BMC IPMI: crafted RAKP+ messages can escalate an account to administrator"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["bmc", "data-center", "infrastructure", "ipmi", "servers"]
not_affected_if: ["ipmi-disabled", "no-bmc"]
published_at: "2026-10-27T08:16:54+00:00"
first_seen_at: "2026-10-27T08:31:47+00:00"
updated_at: "2026-10-27T08:32:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65220", "first_seen_at": "2026-10-27T08:31:47+00:00"}]
---

# BMC IPMI: crafted RAKP+ messages can escalate an account to administrator

A logic flaw in the BMC IPMI implementation lets an attacker send specially crafted RAKP+ messages during authentication. The sources say this can escalate an account to administrator privileges on the baseboard management controller.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Identify BMC or IPMI interfaces on servers and appliances, for example with `ipmitool lan print` from the host or an inventory of management network addresses.
- Check the BMC firmware version against the vendor advisory, which the sources do not name.
- unknown: the sources do not say which BMC vendors or firmware builds are affected.

## Fix

- Update BMC firmware to the vendor's patched release; the fixed version is unknown from the sources.
- Restrict IPMI/BMC network access to a dedicated management network and disable IPMI over LAN where it is not needed.
- Rotate BMC account passwords after patching if administrator escalation may have occurred.

## Timeline

- 2026-10-27T08:31:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65220

## From the sources

A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_