Supermicro BMC SMTP Command Injection (CVE-2026-3820): Overview of a Recurring Firmware Weakness

Introduction

An OS command injection vulnerability in Supermicro's BMC SMTP service configuration lets an authenticated administrator execute arbitrary commands with root privileges on the management controller. The resulting compromise can persist through operating system reinstalls and hardware changes. Supermicro holds nearly 15% of the global server market, and prior research found over 70,000 publicly exposed Supermicro IPMI interfaces on Shodan, so the blast radius of this class of vulnerability extends well beyond a single server model.

The Supermicro AS-2115HS-TNR is a 2U Hyper Server platform based on 4th Generation AMD EPYC processors, designed for data center, cloud infrastructure, and AI/ML workloads. The Baseboard Management Controller (BMC) on these servers provides out-of-band management, including power control, firmware updates, virtual media, and console access, all independent of the host operating system. That independence is why a BMC compromise is so serious. A rooted BMC cannot be remediated through conventional OS-level incident response.

Technical Information

Root Cause: Unsanitized Input in SMTP Configuration

CVE-2026-3820 is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerability is in the SMTP service configuration handler in the BMC firmware. When an administrator configures SMTP alert settings through the BMC web interface, the firmware does not properly sanitize the email configuration parameters for shell metacharacters before it incorporates them into system commands.

Binarly's earlier research on the same class of vulnerability in Supermicro BMC firmware shows the likely mechanism. Binarly found that the cgilib_config_alert function inside the libipmi.so binary builds a shell command for the msmtp binary from the mail parameter in the SMTP configuration, then executes it with the glibc popen() function. Because popen() invokes /bin/sh to parse the command line, the shell interprets any metacharacters embedded in the email address field (such as ;, |, or backticks), which allows command injection.

In Binarly's demonstration, appending shell metacharacters like ;echo BRLY >/tmp/poc;cat to the email address field made the BMC execute those commands with root privileges on its embedded Linux operating system.

This is the first subtype of CWE-78. The application passes external input as arguments to a fixed program (in this case, msmtp), and command separators in that input let attackers insert additional commands.

Two-Stage Exploitation Chain

The NVD description states that an attacker must first "obtain administrator privileges" before injecting into the SMTP configuration, so the attack has two stages.

Stage 1: Obtain BMC Administrator Access. Possible routes include:

• Default or weak credentials on the BMC interface, which are common in environments where nobody changed the BMC passwords from factory defaults
• Credential theft via cross-site scripting (XSS) vulnerabilities previously identified in Supermicro BMC firmware (CVE-2023-40284, CVE-2023-40287, CVE-2023-40288, CVE-2023-40290, CVE-2023-40285, CVE-2023-40286), which could be used to steal session cookies and hijack authenticated BMC sessions
• Credential reuse from other compromised systems

Stage 2: Inject Commands via SMTP Configuration. Once authenticated as an administrator, the attacker opens the SMTP alert configuration page in the BMC web interface and injects shell metacharacters into the email configuration fields. When the configuration is saved and the SMTP process later runs, the injected commands execute with root privileges on the BMC.

Impact: Persistent Controller Compromise

The NVD description explicitly warns of three impacts: denial-of-service attacks, arbitrary code execution, and permanent compromise of the controller. Permanent compromise is the most serious of the three. Research by Eclypsium has shown that BMC vulnerabilities can allow attackers to "persist undetected inside a server or even permanently disable the victim server," because the BMC firmware survives OS reinstalls and even hard drive replacements. A compromised BMC gives an attacker complete control over server hardware, including power management, firmware updates, virtual media mounting, and serial console access.

Patch Information

Supermicro has fixed CVE-2026-3820 in updated BMC firmware releases, detailed in its official advisory published in June 2026. The vulnerability is in proprietary BMC firmware rather than an open-source codebase, so the fix ships as binary firmware images. There are no public code diffs or commit histories to inspect.

The fix targets the SMTP service configuration handler. The updated firmware sanitizes and validates SMTP configuration inputs so they can no longer carry injected commands.

Supermicro's advisory maps each affected motherboard SKU to its fixed BMC firmware version. The fix spans multiple board families:

The advisory lists 23 motherboard models in total, each with its patched firmware version. Administrators must apply the BMC firmware update that matches their motherboard SKU. Supermicro notes that testing and validation of affected products is ongoing. Customers should read the release notes that come with each firmware update for full details.

The Coreweave Red Team and Coreweave researcher Hoang Bui responsibly disclosed the vulnerability.

Affected Systems and Versions

The NVD entry names the Supermicro AS-2115HS-TNR as the affected product. Supermicro's June 2026 advisory, however, lists 23 motherboard models across five board families that need patched firmware, which indicates the vulnerability affects a broader range of products that share the same BMC firmware codebase.

The affected board families and models include:

• X14 series: MBD-X14SBGM, MBD-X14DBG-MAP, MBD-X14DBG-GD, MBD-X14SBT-G, MBD-X14SBT-GAP, and others
• X14DBM and H14 series: MBD-X14DBM-AP, MBD-H14DST-F, MBD-H14DST-FL, MBD-X14DBG-LC, MBD-X14DBG-LC+, MBD-H14DSG-OD, MBD-H14DSG-OM
• B4/BH4 series: MBD-BH4SRG, MBD-B4SA1-CPU, MBD-B4SC1-CPU
• B3 series: MBD-B3SD1-20C-25G
• B14 series: MBD-B14DBE, MBD-B14SBE-CPU-25G, MBD-B14SBE-CPU-AP, MBD-B14DBT

The available sources do not list specific vulnerable firmware version ranges. Treat any BMC firmware version earlier than the fixed versions in the patch table above as vulnerable. The full list of affected Supermicro product models may be broader than the ones named here, because Supermicro notes that testing and validation is ongoing.

Vendor Security History

Supermicro's BMC firmware has had repeated security disclosures, and that record is the context for CVE-2026-3820. The Supermicro Security Center lists these BMC-specific advisories:

That is six separate disclosure events in under three years. The October 2023 disclosure matters most here. Binarly documented command injection in the same SMTP alert configuration component at that time, so CVE-2026-3820 is a recurrence of the same vulnerability class in the same functional area. Binarly's research noted that the security practices in these BMC controllers "still reflect an early 2000s approach and do not meet modern security standards."

The supply chain complicates things further. Binarly found that ATEN developed the Supermicro IPMI firmware component, so the root cause of these vulnerabilities may lie upstream in the firmware supply chain. That makes root-cause remediation harder, because Supermicro has to drive fundamental code-level changes through its supply-chain partner.

Binarly's "Broken Trust" research also documented that CVE-2025-6198, a Supermicro BMC firmware validation logic vulnerability, could be exploited more broadly than first described, reaching full system compromise rather than only unauthorized firmware updates. On that precedent, CVE-2026-3820 may be more exploitable than its current description says.

References

• NVD: CVE-2026-3820
• Supermicro Security Advisory: BMC IPMI Firmware, June 2026
• Supermicro Security Center
• Binarly Research: Vulnerabilities in Supermicro BMCs
• Binarly: Broken Trust: Fixed Supermicro BMC Bug Gains New Life
• Eclypsium: Vulnerable Firmware in the Supply Chain of Enterprise Servers
• CWE-78: Improper Neutralization of Special Elements used in an OS Command
• OWASP: Command Injection
• Supermicro AS-2115HS-TNR Product Page
• Thomas Krenn: Supermicro BMC Safety Instructions January 2026
• Thomas Krenn: USBAnywhere Supermicro IPMI Virtual Media Vulnerability
• Proofpoint: 2026 Vulnerability Exploitation Trends
• SMCI Market Share, Q1 2026