CVE-2026-65219 - Vulnerability Details - OpenCVE

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Smci	Mbd-x12spi

No data.

No data.

References

Link	Providers
https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1

History

Wed, 04 Nov 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 28 Oct 2026 22:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Smci Smci mbd-x12spi
Vendors & Products		Smci Smci mbd-x12spi

Tue, 27 Oct 2026 08:00:00 +0000

Type	Values Removed	Values Added
Description		A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.
Title		Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability
Weaknesses		CWE-696
References		https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: Supermicro

Published: 2026-10-27T07:57:12.003Z

Updated: 2026-11-04T14:59:18.702Z

Reserved: 2026-07-21T20:14:40.863Z

Link: CVE-2026-65219

Vulnrichment

Updated: 2026-11-04T14:52:38.770Z

NVD

Status : Awaiting Analysis

Published: 2026-10-27T08:16:54.363

Modified: 2026-11-04T15:17:45.653

Link: CVE-2026-65219

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65219", "assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "state": "PUBLISHED", "assignerShortName": "Supermicro", "dateReserved": "2026-07-21T20:14:40.863Z", "datePublished": "2026-10-27T07:57:12.003Z", "dateUpdated": "2026-11-04T14:59:18.702Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "shortName": "Supermicro", "dateUpdated": "2026-10-27T07:57:12.003Z"}, "title": "Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-696", "description": "CWE-696: Incorrect Behavior Order", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115: Authentication Bypass"}]}], "affected": [{"vendor": "SMCI", "product": "MBD-X12SPI", "platforms": ["BMC"], "versions": [{"status": "affected", "version": "1.07.20", "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands."}]}], "references": [{"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "credits": [{"lang": "en", "value": "runZero", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T14:52:37.731700Z", "id": "CVE-2026-65219", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T14:59:18.702Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-65219", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-04T14:52:37.731700Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T14:52:38.770Z"}}], "cna": {"title": "Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "runZero"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115: Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SMCI", "product": "MBD-X12SPI", "versions": [{"status": "affected", "version": "1.07.20", "versionType": "custom"}], "platforms": ["BMC"], "defaultStatus": "affected"}], "references": [{"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.", "supportingMedia": [{"type": "text/html", "value": "A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-696", "description": "CWE-696: Incorrect Behavior Order"}]}], "providerMetadata": {"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "shortName": "Supermicro", "dateUpdated": "2026-10-27T07:57:12.003Z"}}}, "cveMetadata": {"cveId": "CVE-2026-65219", "state": "PUBLISHED", "dateUpdated": "2026-11-04T14:59:18.702Z", "dateReserved": "2026-07-21T20:14:40.863Z", "assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "datePublished": "2026-10-27T07:57:12.003Z", "assignerShortName": "Supermicro"}, "dataVersion": "5.2"}