Supermicro BMC EUVD-2026-110637

Exploitation requires an authenticated IPMI Administrator session against the Supermicro BMC management interface (CVSS PR:H), so the attacker must already possess or compromise administrative IPMI credentials - this is the primary limiting factor. The flaw is network-reachable (AV:N), low-complexity (AC:L), and needs no user interaction (UI:N). It is confined to the specified firmware build (MBD-X12SPI 01.07.20) and to reading files from the BMC filesystem (confidentiality only; no write or availability impact). Real-world exposure is further limited where BMC/IPMI interfaces are segregated on isolated management networks rather than reachable from general or untrusted networks.

This is a moderate-severity information-disclosure flaw (CVSS 4.9) in Supermicro BMC/IPMI firmware, and the signals are consistent in pointing to limited, non-urgent real-world risk. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N shows the flaw is network-reachable over the IPMI management interface but requires high privileges (PR:H) - specifically an already-authenticated IPMI Administrator - which substantially narrows the attacker population to insiders or those who have already obtained admin credentials. Impact is confined to confidentiality (C:H/I:N/A:N): an attacker can read arbitrary files from the BMC filesystem but cannot modify or disrupt. EPSS is low at 0.23% (14th percentile), the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present in the supplied data, so this is not a widespread-exploitation priority. The vuln.today decision label is 'this_month', indicating routine scheduled patching rather than emergency action - which aligns with the low EPSS and absence of KEV/PoC signals. The main caveat: because exploitation presupposes IPMI Administrator access, the practical risk hinges on how exposed and well-credentialed each organization's BMC management plane is; a BMC reachable from untrusted networks with weak or default admin credentials raises the effective risk beyond what the PR:H metric alone suggests.

An attacker who already holds (or has compromised) IPMI Administrator credentials on a Supermicro BMC authenticates to the management interface and abuses the file-read capability to retrieve arbitrary files from the BMC filesystem - potentially configuration, credential, or key material beyond what the IPMI role should expose. No user interaction is required (UI:N) and the attack is low-complexity (AC:L), but it is gated behind existing administrative authentication (PR:H). No public exploit code or PoC reference is identified in the supplied data.