CVE-2026-65211
Received Received - Intake

Authenticated IPMI Admin Arbitrary BMC Memory Access Leading to Code Execution

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: Super Micro Computer, Inc.

Description
This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-65211
EUVD
EUVD-2026-110638

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SMCI MBD-X12SPI 01.07.20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated IPMI Administrator to read and write arbitrary BMC physical memory, which can lead to executing code on the BMC operating system.

Impact Analysis

An attacker with IPMI Administrator access could gain full control over the BMC, potentially compromising the entire system, stealing data, or disrupting operations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and security controls.

Mitigation Strategies

Restrict access to IPMI interfaces to trusted networks only. Update BMC firmware to the latest patched version. Disable IPMI Administrator accounts if not required. Monitor BMC memory access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65211. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart