Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability

Summary

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.

Remediation

1. Inventory every SMCI MBD-X12SPI deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1