CVE-2026-16140 OpenBMC CVE debrief

Who should care

Defenders responsible for OpenBMC IPMI implementations, particularly those using downstream vendor solutions like NVIDIA and H3C, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-16140 allows privilege escalation in OpenBMC's IPMI implementation without re-authentication, affecting downstream vendors. Defenders should assess exposure, prioritize remediation, and verify affected versions and patches.

• Privilege escalation without re-authentication
• Potential for unauthorized access and control
• Need for verification of affected versions and vendor patches
• Remediation priority for OpenBMC IPMI implementations

Technical summary

OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw that allows the authorization context of an existing session to be replaced with a target account while maintaining the original integrity and encryption keys. This issue effectively enables privilege escalation without re-authentication and affects several downstream vendors, including NVIDIA and H3C. The vulnerability arises from a flaw in the IPMI implementation's session management, which could allow unauthorized access to IPMI functions.

Defensive priority

High

Recommended defensive actions

• Assess exposure and prioritize remediation for OpenBMC IPMI implementations
• Verify affected versions and vendor patches
• Implement compensating controls and monitor for exploitation attempts
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but specific affected versions, remediation steps, and vendor patches require verification from official sources. The OpenBMC community and downstream vendors like NVIDIA and H3C have acknowledged the issue. However, the extent of affected systems and detailed mitigation strategies are not explicitly stated in the CVE record or NVD entry. Defenders should consult official advisories and verify the integrity of their IPMI implementations to ensure they are not exposed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.