Logic Flaw in OpenBMC's IPMI Implementation Affects Multiple Vendors
CVE-2026-16140

8.8HIGH

Key Information:

Vendor

Openbmc

Status
Phosphor-net-ipmid
Vendor
CVE Published:
15 September 2026

What is CVE-2026-16140?

The IPMI implementation in OpenBMC's phosphor-net-ipmid is susceptible to a logic flaw that enables the unauthorized replacement of an existing session's authorization context with that of a target account. This vulnerability maintains the original integrity and encryption keys, allowing attackers to escalate privileges without the need for re-authentication. Various vendors, such as NVIDIA and H3C, integrate phosphor-net-ipmid within their IPMI solutions, creating potential security risks across multiple systems.

Affected Version(s)

phosphor-net-ipmid 0

References

https://www.runzero.com/advisories/openbmc-ipmi-privsec-r...
third-party-advisory
https://www.runzero.com/blog/lights-out-exposed/
related

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HD Moore of runZero
Gadi Evron of Knostic
Tod Beardsley of runZero
.