Medium severity · published Oct 27, 2026
CVE-2026-65210
Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability
New
4.9
CVSS
0.2%
EPSS
No
On KEV
Description
This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MB
MBD-X12SPI · SMCI
01.07.20 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-65210
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-65210
www.supermicro.com
https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1
More from MBD-X12SPI
8.8
CVE-2026-65220
Supermicro BMC IPMI feature contains a Privilege escalation vulnerability
7.4
CVE-2026-65219
Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability
7.2
CVE-2026-65211
Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability
6.6
CVE-2026-65213
Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability
3.1
CVE-2026-18451
Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token