AI and data stack advisories

Severe, 6 weeks977Projects326

977 severe, 6 weeks · 326 projects

SupermicroCVE-2026-18451

Supermicro MBD-X12SPI: attacker could guess the session token

Supermicro

CVE-2026-18451 · Published Oct 27, 2026

Low3.1
No fix yet
Supermicro advisory

The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.

Affected versions

PackageAffectedFixed in
MBD-X12SPI
Product
<= 01.07.20No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-337

More Supermicro advisories

All Supermicro
Medium 6.6Oct 27Supermicro MBD-X12SPI: code executionCVE-2026-65213no fix yetHigh 7.2Oct 27Supermicro MBD-X12SPI: code executionCVE-2026-65211no fix yetMedium 4.9Oct 27Supermicro MBD-X12SPI: exposed filesCVE-2026-65210no fix yetHigh 7.4Oct 27Supermicro MBD-X12SPI: code executionCVE-2026-65219no fix yetHigh 8.8Oct 27Supermicro MBD-X12SPI: improper privilege managementCVE-2026-65220no fix yetHigh 7.2Oct 27Supermicro MBD-X12STW-F: command injectionCVE-2026-16521no fix yet