Critical Flaws Hit 54% of Internet-Exposed Server Controllers

A control system designed to rescue failed servers can also give attackers a durable route beneath the operating system. Baseboard management controllers, or BMCs, sit on enterprise motherboards with their own firmware, network connection and administrative powers. Research presented at Black Hat on August 5, 2026 found widespread critical weaknesses across devices from major manufacturers, including flaws that have remained useful for more than a decade.

HD Moore, who founded security firm runZero, counted more than a dozen newly identified weaknesses. The affected product lines span HPE and Supermicro, alongside controllers associated with Avocent, Huawei, Lenovo, Dell and additional manufacturers. The precise count was still changing, and details of some flaws were being withheld to give vendors time to issue patches. The disclosed categories nevertheless show how failures in authentication, session handling and firmware verification can be combined into control of a management processor.

The risk is unusually deep because a BMC is not a normal application on the server it manages. Administrators use it to check hardware, reboot an unresponsive machine, install updates and even reinstall an operating system. Those functions remain available when the main server is powered down. An attacker who compromises that separate plane may survive the cleanup steps that would remove ordinary malware.

Two Scans Measure Exposure Inside and Outside Corporate Networks

Moore's Internet-wide scan found more than 86,000 controllers exposing a management service publicly. More than 54% carried at least one critical vulnerability. The figure measures the scanned BMC endpoints, not 54% of all servers on the Internet. It is still significant because management interfaces are commonly expected to sit behind restricted administrative networks rather than accept connections from the public Internet.

A second scan looked inside corporate environments and covered 126,761 BMCs. Nearly 29% had one or more critical flaws. The lower share does not make internal exposure harmless. A compromised employee account, workstation or application server can give an intruder the network position needed to reach management interfaces that are invisible from outside.

The oldest result is also one of the largest. CVE-2013-4786 may still affect up to 75,000 of the publicly reachable devices. The decade-old problem sits in IPMI 2.0 authentication. It permits collection of password-verification material for offline cracking of administrator credentials. The finding shows that removing an interface from a vulnerability scanner after a partial mitigation is not the same as replacing weak credentials, disabling an unneeded protocol or updating every controller in a fleet.

Small Protocol Failures Can Chain Into Persistent Control

The new research describes several paths rather than one universal exploit. Some implementations mishandle the IPMI authentication sequence, allowing a request to advance without the expected proof of identity. Others accept unsigned or unencrypted commands inside a session that was supposed to enforce integrity and encryption. Predictable session identifiers can let an attacker take over a live management session, including a browser-based remote console.

Other weaknesses sit closer to the firmware. Moore found pre-authentication memory corruption in an HPE management SSH service. The research also identified products that accept unsigned or attacker-controlled firmware, expose secrets that can be recovered from public firmware images or ship with factory-generated passwords drawn from spaces small enough for practical offline cracking. A limited foothold can therefore become administrator access, and administrator access can become a persistent implant.

That persistence changes incident response. If defenders reinstall the server's operating system while leaving a compromised BMC untouched, the controller can interfere with the rebuilt machine or restore malicious behavior. In some cases, an attacker controlling the operating system can also use host-side access to tamper with the BMC. The two environments can reinfect each other, turning a standard rebuild into an incomplete recovery.

The danger has moved beyond laboratory demonstrations. Researchers disclosed ILObleed in 2021 after finding an implant on HPE servers that installed disk-wiping firmware. It survived operating-system reinstalls and hard-drive replacements because the malicious component remained in the management controller. A 2025 CISA catalog update separately marked a critical AMI controller bug as already exploited.

Defenders Need an Inventory Before They Can Close the Management Plane

Moore released an open-source utility called OOBscan to find BMC weaknesses across server fleets. Discovery is the first task because organizations may track a server's operating system while lacking a current record of its controller model, firmware version, exposed services and credential state. An inventory should connect each BMC to an owner and a patch path, not merely produce another list of addresses.

Network placement offers the fastest reduction in exposure. Management interfaces should not be reachable from the public Internet. Moore also recommended isolating each BMC network interface rather than placing many of them on a shared virtual LAN, disabling IPMI wherever operations allow and disabling the host-side Keyboard Controller Style channel when it is not required. Those controls reduce the number of routes an attacker can use while firmware fixes are tested and deployed.

Credentials need separate treatment. Long, unique usernames and complex passwords make offline cracking less useful, especially where default or narrowly randomized factory credentials remain. Teams should rotate credentials when a controller changes hands, avoid reusing management passwords across racks and verify that monitoring can detect authentication attempts and firmware changes on the out-of-band network.

The practical priority is to remove public reachability, map every controller, apply vendor updates and then test whether legacy protocols can be shut off without disrupting recovery operations. The parallel management plane should receive the same ownership, logging and patch discipline as the servers it controls. Otherwise, the tool meant to restore a failed machine remains a quieter system that can outlast both the machine's operating system and the defender's first cleanup.