SMCI
Vulnerability activity for SMCI: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 9
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 9
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 9
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.6MediumOct 27, 2026SMCI MBD-X12SPI Code / command injectionCVE-2026-65213This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC
- 7.2HighOct 27, 2026SMCI MBD-X12SPI Auth bypass / access controlCVE-2026-65211This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.
- 8.8HighOct 27, 2026SMCI MBD-X12SPI Privilege escalationCVE-2026-65220A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.
- 7.4HighOct 27, 2026SMCI MBD-X12SPICVE-2026-65219A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.
- 4.9MediumOct 27, 2026SMCI MBD-X12SPI Path traversal / file handlingCVE-2026-65210This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.
- 3.1LowOct 27, 2026SMCI MBD-X12SPICVE-2026-18451The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.
- 9.8CriticalOct 27, 2026SMCI X12SPI Auth bypass / access controlCVE-2026-18450The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
- 7.5HighOct 27, 2026SMCI X12SPI Auth bypass / access controlCVE-2026-18449The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
- 7.2HighOct 27, 2026SMCI MBD-X12STW-F Code / command injectionCVE-2026-16521An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted.
Top products
- MBD-X12SPI6 CVEs in the last year
- X12SPI2 CVEs in the last year, 1 critical
- MBD-X12STW-F1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.