IBM OpenBMC EUVD-2026-49886

Exploitation requires a valid ReadOnly user account on the affected IBM OpenBMC interface - this is the sole prerequisite beyond network access to the BMC management interface. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation by any authenticated low-privilege user with no additional complexity or user interaction required. No special non-default configuration is required; ReadOnly accounts are a standard role in OpenBMC deployments. Exploitation is bounded by two limiting factors: the attacker must first possess or obtain a ReadOnly credential (PR:L), and BMC network access is typically isolated to a dedicated management VLAN or out-of-band network, restricting which hosts can reach the interface. SSVC automatable=no suggests the privilege escalation mechanism may require per-target interaction and is not trivially bulk-exploitable across arbitrary targets.

The CVSS 8.8 score is well-calibrated: the combination of network-accessible attack vector (AV:N), no complexity barrier (AC:L), and low-privilege requirement (PR:L) means any holder of a ReadOnly BMC credential can achieve full administrator access. BMC administrator control is particularly impactful - it is persistent across host OS reinstalls, enables virtual media mounting for implant delivery, and provides power-cycle capability over production workloads. However, multiple signals moderate operational urgency: EPSS at 0.17% places this in the 7th percentile for exploitation likelihood; CISA KEV lists no active exploitation; SSVC rates exploitation as none and automatable as no; and no public exploit code has been identified. The SSVC partial technical impact designation may understate real-world consequences, since full BMC admin yields substantial physical infrastructure control. The credential prerequisite (PR:L) is the primary limiting factor - an attacker must first obtain a valid ReadOnly account, typically via credential theft, password reuse, phishing of NOC or monitoring personnel, or a malicious insider. Organizations that have provisioned ReadOnly accounts for third-party vendors, shared monitoring integrations, or less-trusted operational staff should prioritize patching.

An attacker who has obtained a ReadOnly BMC credential - for example by compromising shared NOC monitoring account credentials or exploiting password reuse - authenticates to the IBM OpenBMC REST API or web interface over the network. By exploiting the CWE-863 incorrect authorization flaw, they modify their own role to administrator without any further interaction. With full BMC administrator access, they can mount attacker-controlled virtual media, power-cycle production servers disruptively, or extract hardware event logs, with persistence that survives host OS reinstalls. No public exploit code has been identified at time of analysis.