VulnerabilityAwaiting Analysis

CVE-2026-18451

Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.

LOW 3.1EPSS —

Does this matter?

Lower severity and no EPSS score yet. Track it; it rarely justifies an emergency change on its own.

Description

The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.

CVSS 3.1: 3.1 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS: No score yet
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-337
Source: def9a96e-e099-41a9-bfac-30fd4f82c411

References

https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.