Newly Disclosed Server Management-Chip Flaws Put AI Data Centers at Backdoor Risk

The tiny computers that watch over the world's servers have a problem: they are riddled with holes, and almost nobody is looking at them. At Black Hat 2026 in Las Vegas this week, firmware researcher HD Moore disclosed more than a dozen previously unknown vulnerabilities in baseboard management controllers (BMCs) — the embedded chips that let administrators run servers even when the machines are powered off — spanning hardware from nearly every major vendor. The findings land squarely on the AI industry, whose sprawling GPU fleets sit on exactly the kind of infrastructure Moore says is quietly rotting.

What researchers found

Moore, the founder and CEO of exposure-management firm runZero (and the original author of Metasploit), presented the research in a talk pointedly titled "Lights Out: BMCs Are Still Broken and Now We Have the Receipts." According to runZero's disclosure, updated August 5, the flaws affect BMC implementations from OpenBMC, Supermicro, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM, and Fujitsu — effectively the entire market. Additional reporting from Ars Technica and others named Avocent, Huawei, and Lenovo among affected vendors as well.

To gauge real-world exposure, Moore ran two scans. An internet-wide sweep turned up roughly 86,000 publicly reachable BMCs, and more than 54 percent carried at least one critical vulnerability. A separate internal survey counted over 120,000 BMCs inside corporate networks, of which about 29 percent had at least one critical flaw. Many of the newly found bugs require prior authentication to exploit, Moore cautioned — but he noted that a well-resourced attacker can often chain smaller pre-authentication weaknesses to get there.

"The end result is a pervasive, under-monitored, under-patched parallel attack surface that is both Internet-exposed and widespread inside corporate networks, and is much more exploitable than many folks realize," Moore told Ars Technica.

Technical details for the individual CVEs are being withheld until vendors ship fixes, in line with coordinated disclosure. But the research also revisits how little has changed since Dan Farmer's landmark 2013 IPMI work, which exposed the "Cipher Zero" authentication bypass and RAKP password-hash disclosure in the Intelligent Platform Management Interface that underpins most BMCs. runZero found that as many as 75,000 devices remain vulnerable to CVE-2013-4786, an IPMI 2.0 flaw that lets an attacker pull administrator password hashes and crack them offline. A vulnerability older than the iPhone's home button is still live on tens of thousands of servers.

Why a chip most people never see matters so much

A BMC is a small, always-on computer welded to the server's motherboard. It runs its own firmware, has its own network interface, and answers even when the host operating system is dead or the machine is unplugged from everything but power. That is by design — it is how a data-center operator reboots a hung box, reinstalls an OS, or checks a fan speed from a thousand miles away. It is also exactly why the BMC is such a prize. Sitting beneath the operating system, a compromised BMC gives an attacker a foothold that conventional endpoint detection tools cannot see and that survives an OS wipe. Reimage the server all you want; the intruder is still living in the basement.

That threat model is not hypothetical. The past two years have seen a steady drumbeat of critical BMC bugs: CVE-2024-54085, an AMI MegaRAC authentication bypass rated a maximum CVSS 10.0 and flagged by CISA as under active exploitation; and Supermicro's CVE-2025-7937 and CVE-2025-6198, which security firms warned could defeat the BMC's root-of-trust and plant firmware that persists across reboots and OS reinstalls. Moore's research argues these are not one-off slips but symptoms of a systemically neglected layer.

For AI operators, the stakes are unusually concentrated. A modern training cluster packs thousands of GPUs, each attached to a server with a BMC, into a handful of racks holding proprietary model weights, customer data, and staggeringly expensive compute. That concentration is a feature for efficiency and a liability for security: an attacker who owns the management plane of an AI data center could exfiltrate model artifacts, quietly tamper with training runs, or brick hardware — all beneath the visibility of the security stack cloud tenants actually trust. The "out-of-band" network meant to keep operators in control becomes a hidden highway for whoever gets there first.

What to watch

The individual CVEs will trickle out as disclosure deadlines expire and vendors patch, and Moore said runZero will flag each as it lands. In the meantime, the practical guidance is unglamorous but urgent: get BMC interfaces off the public internet, restrict management access to trusted subnets or a dedicated VPN, and build a real patching process that treats firmware as a first-class asset rather than an afterthought. The harder question is cultural. If a 13-year-old flaw is still live on 75,000 servers, the industry's habit of treating the management plane as invisible plumbing is the real vulnerability — and the AI build-out is pouring the world's most valuable compute directly on top of it.