CVE-2026-16140

HighCVSS 8.8

Published: 15/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

20th percentile - higher than 20% of all known CVEs

Summary

Vulnerability in phosphor-net-ipmid, OpenBMC's IPMI implementation. A logic flaw allows replacing the authorization context of an existing session with a target account while maintaining the original integrity and encryption keys, leading to privilege escalation without re-authentication.

Risk Assessment

An attack can lead to unauthorized access to higher-privileged accounts and full compromise of the management system.

Recommendation

Update phosphor-net-ipmid to a patched version and monitor IPMI sessions for unusual privilege changes.

Other vulnerabilities in phosphor-net-ipmid

CVE-2026-16141High
Vulnerability in phosphor-net-ipmid, OpenBMC's IPMI implementation. An unauthenticated client can force the RAKP Message 1 handler to return early before overwriting the authentication object's defaults. The IPMI service then accepts a RAKP Message 3 with HMAC computed using a constant 20-byte 'userKey' initialized from '0penBmc' and an often-predictable 'bmcRandomNum'.

Original NVD description (English source)

OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C. This issue effectively allows for privilege escalation without re-authentication.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS