{"id":"CVE-2026-3821","aliases":["EUVD-2026-47615","GHSA-cjff-5v28-x7h8"],"status":"published","title":"Supermicro SMASH service contain an Arbitrary code execution issue","description":"Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI.\nAn authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00638,"percentile":0.5105,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-07-22T06:15:31Z","modified":"2026-10-24T17:10:00Z","products":[{"vendor":"smci","product":"x14dbg-dap,x14dbi"}],"references":[{"url":"https://www.supermicro.com/en/support/security_BMC_IPMI_Jul_2026"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3821"},{"url":"https://github.com/advisories/GHSA-cjff-5v28-x7h8"}],"sources":{"cve":[{"id":"CVE-2026-3821","title":"Supermicro SMASH service contain an Arbitrary code execution issue","description":"Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI.\nAn authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.","status":"published","published":"2026-07-22T06:15:31.648Z","modified":"2026-07-22T12:57:22.874Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:49:09.229322Z"}],"euvd":[{"id":"EUVD-2026-47615","description":"Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI.\nAn authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.","status":"published","published":"2026-07-22T06:15:31Z","modified":"2026-07-22T12:57:22Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:46.900828Z"}],"ghsa":[{"id":"GHSA-cjff-5v28-x7h8","title":"Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and...","description":"Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI.\nAn authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.","status":"published","published":"2026-07-22T09:32:13Z","modified":"2026-07-22T09:32:20Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:09:38.678188Z"}],"nvd":[{"id":"CVE-2026-3821","description":"Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI.\nAn authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.","status":"published","published":"2026-07-22T07:16:35.413Z","modified":"2026-10-24T17:10:00.22Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:32.089897Z"}]}}