What’s Vulnerable › Vulnerabilities
CVE-2026-3820: Supermicro BMC's SMTP service contains a command injection vulnerability
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-04 · updated 2026-07-22
- Weakness: CWE-78
Description
There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR. An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation. Potential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.
Affected products
- SMCI AS-2115HS-TNR: 01.08.01, 01.06.04
References
Get alerted when CVE-2026-3820 or the next vulnerability affects your stack