VulnSocial

CVE-2026-65219

LOWCVSS 7.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-696

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-27: 110-27
Referenced assets1 URL
By indicator
Full discourse1 post
  • Eliran Emuna@EmunaEliran

    🚨 Supermicro server BMCs: a CVSS 9.8 flaw may let an attacker inject IPMI commands into an active session 🆔 CVE-2026-18450 · CVSS 3.1 9.8 (Supermicro, CNA): the BMC doesn't correctly enforce integrity and encryption requirements for IPMI commands, so crafted packets may execute arbitrary commands on an active RMCP+ session 📦 Part of an 8-CVE BMC firmware advisory (Oct 26, 2026) credited to runZero researchers, incl. CVE-2026-65219 · 7.4: an out-of-order RAKP message 3 may grant an IPMI session ✅ Fixed BMC firmware is listed per motherboard across X11-X14 and H11-H14 boards (e.g. X12SPi-TF: 01.07.27); a few SKUs are still TBD ⚠️ Supermicro says it is not aware of malicious use in the wild. Not in CISA KEV 🛡️ Update the BMC firmware and keep IPMI/BMC interfaces off the internet 🔗 https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1 #Supermicro #IPMI #CVE

    0000024
    74 followersView on X

Explore more

Back to dashboard