First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-65211

HighCVSS 7.2/10Last modified Nov 4, 2026

Description

This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
SMCI	MBD-X12SPI	01.07.20

References

https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-652136.6This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC CVE-2026-652197.4A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an CVE-2026-65225.5RPKI-Router protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-652208.8A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to admini CVE-2026-65235.5GNW protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-65245.5MySQL protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-65255.5IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.4 CVE-2026-65265.5RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 CVE-2026-65275.5ASN.1 PER protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-65285.5TLS protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 allows denial of service CVE-2026-65295.5iLBC audio codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-65305.5DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

CVE-2026-65211: High severity, CVSS 7.2 | Vulnix