# AMI MegaRAC BMC authentication bypass enables remote code execution

Published: 2026-06-09 · Severity: routine · Sectors: government-national, defense, manufacturing, technology, infrastructure
Canonical: https://vorant.io/reports/57d8d166-33c9-50be-acec-2d3478952650/ami-megarac-bmc-authentication-bypass-enables-remote-code-execution

> Authentication bypass in AMI MegaRAC BMC firmware allows unauthenticated remote code execution; proof-of-concept available.

A critical authentication bypass vulnerability has been discovered in AMI MegaRAC Software, a widely-deployed BMC firmware package used for out-of-band remote management of enterprise servers. The vulnerability exists in the Redfish Host Interface and allows an attacker to bypass authentication remotely, enabling complete server compromise. Successful exploitation grants attackers the ability to remotely control compromised servers, deploy malware and ransomware, tamper with firmware, brick motherboard components including BMC and BIOS/UEFI, cause physical damage through over-voltage attacks, and trigger indefinite reboot loops that victims cannot interrupt.

The vulnerability affects AMI UEFI versions prior to BKC_5.38 and AptioV versions prior to BKC_5.38, as well as specific versions of HPE Cray XD670 and ASUS RS720A systems. Proof-of-concept exploitation code has already been published by security firm Eclypsium, indicating active research and likely near-term weaponization. This is a critical vulnerability affecting infrastructure management layers, requiring immediate patching of affected systems.

Defenders should prioritize applying vendor-supplied updates immediately after testing, implement network segmentation to isolate BMC management interfaces, enforce the principle of least privilege, conduct vulnerability scanning and penetration testing of infrastructure management systems, and ensure robust vulnerability management and remediation processes are in place.

## Mentioned in this report

- Vulnerabilities: CVE-2025-54085

## Detection guidance (public sample)

### Redfish API BMC Account Creation or Modification via Web Request

ATT&CK: T1190

Detects POST/PATCH/PUT requests to the Redfish AccountService accounts collection on a BMC web interface, a likely post-exploitation step after a MegaRAC Redfish authentication bypass to gain persistent BMC admin access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Redfish API BMC Account Creation or Modification via Web Request
id: 3e6f7f73-142f-5f95-afea-ed8903b04596
status: experimental
description: Detects write requests (POST/PATCH/PUT) to the Redfish AccountService
  Accounts endpoint on BMC or management web interfaces. After an authentication bypass
  in AMI MegaRAC Redfish, creating or altering BMC accounts is a likely way to gain
  persistent administrative access. Requires BMC, management-network proxy or reverse-proxy
  web logs. Correlate with the source address not being a known management host.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method:
    - POST
    - PATCH
    - PUT
    cs-uri-stem|contains: /redfish/v1/AccountService/Accounts
  condition: selection
falsepositives:
- Legitimate administrators or provisioning tooling (Ansible, vendor lifecycle managers)
  creating or rotating BMC accounts from the management network
- Server onboarding automation during initial rack and stack
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-ami-megarac-software-could-allow-for-remote-code-execution_2025-028
```

### Redfish API Firmware Update or Host Reset Action Request

ATT&CK: T1190

Detects POST requests to Redfish UpdateService or ComputerSystem Reset actions, which an attacker with a BMC authentication bypass could use to tamper with firmware or force reboot loops. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Redfish API Firmware Update or Host Reset Action Request
id: 8d895a77-670b-51fc-a862-e34e0286d786
status: experimental
description: Detects POST requests to Redfish UpdateService actions or ComputerSystem
  Reset actions on BMC web interfaces. Post-exploitation of an AMI MegaRAC Redfish
  authentication bypass may involve flashing tampered BMC/BIOS firmware or repeatedly
  resetting the host. Requires BMC, management-network proxy or reverse-proxy web
  logs; baseline against change windows.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: POST
  selection_uri:
    cs-uri-stem|contains:
    - /redfish/v1/UpdateService
    - /Actions/ComputerSystem.Reset
  condition: selection_method and selection_uri
falsepositives:
- Scheduled firmware maintenance performed by infrastructure teams or vendor lifecycle
  tooling
- Orchestration platforms rebooting hosts through Redfish power actions
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-ami-megarac-software-could-allow-for-remote-code-execution_2025-028
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-ami-megarac-software-could-allow-for-remote-code-execution_2025-028

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/57d8d166-33c9-50be-acec-2d3478952650/ami-megarac-bmc-authentication-bypass-enables-remote-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup