Supermicro publishes advisory for BMC IPMI CVEs on servers
Supermicro maintains a security advisory page for CVEs affecting the BMC, the out-of-band IPMI management interface of its servers. The available material lists no CVE numbers, affected versions, or patch status, and the topic drew discussion in the security community (r/netsec). Administrators running Supermicro servers should check the vendor advisory and apply whatever it recommends.
What happened
Supermicro has posted a security advisory page for CVEs affecting the BMC, the out-of-band IPMI management interface of its servers. The topic is under discussion in the security community on r/netsec. The available text gives no CVE numbers, affected versions, or patch status.
Why it matters
The BMC/IPMI allows remote server management, including outside the operating system. Flaws in this interface could compromise management of equipment for any company running Supermicro servers in its data centers.
What to do
Check Supermicro's security advisory page and apply whatever the vendor recommends. In the meantime, verify the BMC firmware version and restrict IPMI access to the management network.
For the technical team
- Affected
- BMC, interface IPMI de gerenciamento de servidores Supermicro · Supermicro servers with BMC/IPMI. Affected versions not stated in the sources.
- Exploitation
- No public PoC or reported exploitation in the sources. Case at disclosure stage, with discussion on r/netsec.
- Fix
- Not stated in the sources.
- Vector
- Component: BMC, the out-of-band IPMI management interface of Supermicro servers. Failure type and exploitation conditions not stated in the sources.
- More details
- Supermicro maintains a security advisory page on its site (security_BMC_IPMI_Oct_2026_1), whose URL indicates October 2026. Discussion opened in the r/netsec community. CVE numbers absent from the available material.
Timeline
Incident opened.
Sources 1 source
- Supermicro BMC ipmi cves r/netsec
