CVE-2026-65199

MediumCVSS 5.4

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated but low-privilege SNMP user can invoke mapped backend operations as an administrative identity. In route_mapper/account.lua, get_user_privilege returns the complete nine-privilege set for a special_users group that includes the SNMPv1_v2c pseudo-user.

Risk Assessment

A low-privilege SNMP user can perform administrative operations, leading to privilege escalation and unauthorized system changes. The risk is high in environments with SNMP enabled.

Recommendation

Apply the openUBMC fix that restricts the SNMPv1_v2c pseudo-user privileges. Until patched, restrict SNMP access and use least-privilege accounts.

Other vulnerabilities in openUBMC

CVE-2026-65200Low
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus.

Original NVD description (English source)

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS