BMC security remains a low priority in many IT departments, often considered a done deal once remote access has been set up once. The figures from the summer of 2026 tell a different story.
Nearly one in three baseboard management controllers examined has at least one critical vulnerability. The BMC runs independently of the operating system, is not detected by antivirus scanners or system updates, and some malware can even survive a reinstallation. Effective measures for BMC security include a separate management network, documented firmware versions, changed default passwords, and a Complete inventory.
Baseboard management controllers were still vulnerable in 2026 to CVE-2013-4786, a publicly documented vulnerability dating back to 2013. Thirteen years without a patch.
HD Moore and runZero via Ars Technica, 2026
What Makes BMC Security So Challenging
The Baseboard Management Controller runs independently of the main operating system, with its own firmware, its own network access, and often its own default login credentials set at the factory. It is precisely this independence—which makes the BMC so useful in an emergency—that makes it a target that many security processes simply overlook. Antivirus software does not scan the BMC, regular operating system updates do not patch it, and restarting the server is often completely ineffective against certain BMC threats.
At Black Hat 2026, security researcher HD Moore presented more than a dozen new vulnerabilities in BMCs from various manufacturers, including HPE iLO, Supermicro, Dell, and Lenovo (HD Moore via Ars Technica, 2026). This range shows that this is not an isolated problem affecting a specific manufacturer, but rather a structural pattern across the entire industry. Therefore, choosing a particular brand alone does not provide protection.
Just how widespread the problem actually is
runZero analyzed its own scan data for this report. Of the 126,761 BMCs examined, 29 percent had at least one critical vulnerability (runZero, 2026). This means that nearly one in three controllers examined is affected—far more than just a few forgotten test servers.
CVE-2021-39296 in the open-source project OpenBMC illustrates just how serious individual vulnerabilities can be: a remote code execution vulnerability requiring no authentication whatsoever, with the highest possible CVSS score of 10 (Google Security Research, 2021). An attacker needs neither a password nor a user account nor prior login. Network access to the BMC is sufficient.
If the malware survives the reboot
BMC security becomes particularly problematic when traditional responses fail. The iLObleed malware, documented in 2021, embeds itself so deeply in the BMC that it survives a complete reinstallation of the operating system (2021, via InfoQ, 2026). A team that wipes the server and reinstalls the operating system considers the incident resolved, while the actual infection continues to run in the controller.
An analysis by NVIDIA from June 2025 examined 18 vulnerabilities in BMC implementations and was able to demonstrate working exploits for nine of them. Among other reasons, the analysis cites the lack of basic protection mechanisms such as ASLR (Address Space Layout Randomization), which has long been standard on regular server operating systems (NVIDIA, 2025). In this regard, BMC firmware often lags years behind the security level of the main operating system.
Five Steps to Improve BMC Security
| Action | What it prevents |
|---|---|
| Separate management network, either physically or via VLAN | Direct access from the production network or the Internet |
| Change Factory Passwords | logging in with credentials taken from the manufacturer's manual |
| Document and Maintain Firmware Versions | vulnerabilities left open for years although a patch has long been available |
| Access Logs at the BMC Level | Unnoticed login attempts |
| Complete inventory of all BMCs | Controllers on the network that no one knows about anymore |
None of these measures is sufficient on its own. A separate management network—physically isolated or at least separated by a VLAN—should be the starting point for any planning. The BMC must not be connected to the same network segment as regular production traffic, and certainly not directly to the Internet.
Factory-set default credentials are among the most commonly overlooked vulnerabilities. Many BMCs leave the factory with a fixed username and a password listed in the manufacturer’s documentation. If this password remains unchanged after commissioning, an attacker with network access doesn’t need a single exploit—a glance at the manual is all it takes.
The very first step is a comprehensive inventory—that is, determining how many BMCs are active on the network, what firmware they’re running, and which of them are even known to exist. Anyone who can’t answer this question most likely has controllers on the network that no one is even aware of anymore.
Inventory of Our Own BMC FleetWe analyze firmware versions, open ports, and default accounts across all locations and identify areas where action is needed.
BMC Security as Part of Fleet Management
Anyone who manages BMCs centrally through a software solution such as KVM Fleet has at least laid the groundwork for this inventory, because every connected controller is visible in one place. That is no substitute for a dedicated security strategy, but it creates the overview without which firmware versions and access rights can hardly be maintained consistently. How to plan the switch from IPMI to the more modern Redfish protocol is described in the article on the IPMI-Redfish Migration, and the access path itself is explained in the article on Out-of-Band Management.
Frequently Asked Questions
How can you find out which BMCs are publicly accessible on your network?
A network scan of the relevant management ports, combined with a query of the firmware version for each device found, provides an initial overview. Security researchers use automated scanning tools for large-scale analyses; within one’s own organization, a structured inventory of all known BMC IP addresses is often sufficient as a starting point.
Is a VPN enough to secure BMC access?
A VPN significantly reduces the attack surface compared to a BMC that is openly accessible on the Internet, but it does not provide complete protection. Within the VPN, vulnerabilities such as CVE-2021-39296 or outdated default credentials can still be exploited.
How often should BMC firmware be updated?
The available data does not support a fixed, universally applicable timeline. It makes sense to establish a regular, documented schedule—for example, as part of every major maintenance window—combined with an immediate review as soon as a manufacturer reports a critical vulnerability.
The Next Step
torck manages its own BMCs via KVM Fleet and therefore has firsthand insight into which login credentials and firmware versions are exposed within a fleet. This experience, gained at the Maxhütte-Haidhof, Vienna, and Rabat locations, is incorporated into the software’s security features. The Product Page shows how KVM Fleet helps with this.
German 
English 
French