By At Black Hat USA 2026 last week, runZero founder HD Moore put a number on a problem the security community has been quietly ignoring for years: 86,000 baseboard management controller (BMC) interfaces are exposed directly to the public internet, and 54% of them carry at least one critical vulnerability. This is not theoretical. Lava Research independently demonstrated cracking admin credentials on thousands of data center servers — in minutes — using a vulnerability first disclosed in 2013. If you run bare-metal servers and haven’t audited your BMC exposure, you should stop what you’re doing.
What Is a BMC and Why Should You Care
A BMC is a specialized microcontroller embedded in server motherboards. It has its own processor, memory, and network interface, and it runs independently of the main operating system. That is the point of it: when a server is powered off, when the OS has crashed, when nothing else responds, the BMC is still running, waiting for you to connect and fix things remotely. It controls power, console access, hardware health monitoring, firmware updates, and virtual media mounting.
That same always-on independence is what makes a compromised BMC catastrophic. An attacker with BMC access has more control than OS-level root. They can manipulate firmware, alter the boot process, and reinstall the operating system to their specifications. A full OS wipe does not evict a BMC-level attacker. Their foothold survives in firmware, invisible to every host-based security tool you have.
The Flaw That Cannot Be Patched
The centerpiece of the problem is CVE-2013-4786. The IPMI 2.0 authentication protocol, which BMCs use to handle remote connections on UDP port 623, sends a password-derived hash to any client that asks — before authentication is complete. An unauthenticated attacker on the internet can request that hash and then crack it offline at their leisure, with no lockout risk whatsoever.
The year 2013 is not a typo. This was disclosed thirteen years ago. Dell reviewed it and concluded there is no fix: “this is an inherent problem with the specification for IPMI v2.0.” The protocol was designed this way. Lava Research’s July 2026 scan found 24,650 internet-exposed servers leaking admin password hashes before login, with over 30% of those hashes crackable using common wordlists or predictable factory password formats. Modern Supermicro and HPE hardware. Exposed right now.
Twelve New Vulnerabilities, Eight Vendors, One Embargo
Beyond CVE-2013-4786, Moore’s “Lights Out” research identified 12 or more new vulnerabilities spanning eight of the most widely deployed BMC platforms: OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM, and Fujitsu BMC. Supermicro accounts for more than half of the internet-exposed BMCs in the scan data.
The specific CVE identifiers and affected firmware versions remain under coordinated disclosure embargo while vendors prepare patches. Supermicro has already published a firmware advisory. Others are pending. The gap between “researcher knows the exploit” and “you have the patch” is the dangerous window — and you are in it now.
These new flaws include authentication bypass and session hijacking techniques that can be chained onto CVE-2013-4786. The attack path: grab the hash via the unfixable IPMI 2.0 flaw, crack it, then use one of the new CVEs to pivot from credentials to full remote code execution or persistent hardware compromise.
What You Must Do Right Now
Most of this does not require waiting for vendor patches.
Immediate actions (no patch needed):
- Block UDP port 623 at your network edge. This cuts off external access to the IPMI service entirely.
- Move BMC network interfaces to an isolated management VLAN, separate from production traffic and internet-reachable interfaces.
- Rotate every BMC and IPMI credential. Factory defaults follow predictable patterns that appear in wordlists. Change them now.
- Disable IPMI-over-LAN if you do not strictly require it. On Dell systems: iDRAC web interface or
racadm set iDRAC.IPMILan.Enable 0. - Disable the IPMI 1.5 cipher suite — deprecated, weak, still enabled by default on many platforms.
Audit your exposure:
# Fingerprint BMC via Nmap
nmap -sU --script ipmi-version -p623 <BMC_IP>
# Audit a full subnet
nmap -sU --script ipmi-version -p623 192.168.1.0/24
# Or run runZero's open-source OOBscan
# github.com/runZeroInc/oobscanrunZero also released OOBscan, a free open-source tool that tests BMCs for protocol exposures, pre-auth information leakage, default credentials, and known-vulnerable firmware. It is what drove the Black Hat 2026 research and is worth running against your own infrastructure before someone else does.
Patch actions (do not wait):
- If you run Supermicro hardware, check the July 2026 BMC firmware advisory and update all affected SKUs now.
- Monitor HPE, Dell, AMI, and other vendor security pages for new advisories. CVE details will drop as coordinated disclosure completes. You want the patch the day it ships.
- Establish a formal BMC firmware patching process if you do not have one. This class of device has been treated as install-and-forget for too long.
The Bigger Problem
BMC security has been a known neglected area for over a decade. DEF CON researchers called IPMI a “sanctioned backdoor” into enterprise networks years ago. The exposure is not shrinking — Lava’s data shows 36,872 IPMI interfaces accessible from the internet in 2026. The cloud era led many teams to treat server firmware as someone else’s problem. For teams still running bare-metal — or whose cloud providers are running it for them — it never was.
The full technical details from runZero’s “Lights Out” research are worth reading. Block the port. Isolate the interface. Update the firmware. Do not wait for a breach to make this a priority.
