Supermicro X12SPI BMC CVE-2026-18450

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands, so an attacker who can send packets to the BMC's IPMI interface can craft messages that execute arbitrary commands against an active session. Concrete prerequisite stated in the description: an active IPMI session must exist for the attacker to target ('execute arbitrary commands on an active session'). Primary limiting factor: network reachability of the BMC/IPMI management interface - these controllers are commonly placed on isolated out-of-band management networks, so exploitation realistically requires access to that management segment. No authentication is required per the CVSS vector (PR:N). Affected: Supermicro X12SPI 01.07.20.

Signals conflict in a way worth stating plainly. The CVSS 3.1 base score is 9.8 Critical (AV:N/AC:L/PR:N/UI:N, full C:H/I:H/A:H), describing a network-reachable, unauthenticated flaw with total impact on the BMC - consistent with the CWE-306 (missing authentication) root cause, where integrity and encryption requirements for IPMI commands are not enforced. The vuln.today decision label is act_now, which sets prioritization urgency. Against that, EPSS is only 0.40% (34th percentile), the vulnerability is NOT in CISA KEV, and no public exploit code is present in the provided data - so there is no evidence of active or widespread exploitation today. The low EPSS alongside a critical, unauthenticated score is best read as 'not yet broadly weaponized' rather than 'low risk': the real-world exposure is strongly mitigated by the fact that BMC/IPMI management interfaces are typically segregated onto out-of-band management networks and should not be internet-facing. The honest conclusion is a genuinely high-severity flaw whose practical risk hinges on management-network exposure; treat it as act_now for patching on Supermicro X12SPI estates while noting exploitation probability signals are currently low. No SSVC exploitation/automatable/technical-impact decision values were supplied beyond the act_now label, so the SSVC framework cannot be reproduced here.

An attacker with network access to the BMC's IPMI interface crafts packets that abuse the BMC's failure to enforce integrity and encryption, injecting arbitrary commands into an active IPMI session to gain control of the baseboard management controller. Because no authentication is required (PR:N) and complexity is low, reachability of the management interface is the main gating factor. No public exploit code is identified in the provided data.