Ami

Known Exploited Ami Vulnerabilities

The following Ami vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

The vulnerability CVE-2024-54085: AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 6 vulnerabilities in Ami with an average score of 7.5 out of ten. Last year, in 2025 Ami had 7 security vulnerabilities published. At the current rates, it appears that the number of vulnerabilities last year and this year may equal out. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.73.

Recent Ami Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-0893	Oct 13, 2026	AMI APTIOV BIOS Local Info Disclosure AMI APTIOV contains a vulnerability in BIOS where an attacker may cause Exposure of Sensitive Information to an Unauthorized Actor by local access. Successful exploitation of this vulnerability can lead to information disclosure, privilege escalation, and further impact on Confidentiality, Integrity, and Availability.	Aptio V
CVE-2025-58774	Oct 13, 2026	AMI APTIOV Buffer Access with Incorrect Length Vulnerability AMI APTIOV contains vulnerabilities in BIOS where users may cause Buffer Access with Incorrect Length Value by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.	Aptio V
CVE-2025-58773	Oct 13, 2026	AMI APTIOV BIOS OOB Write Code Execution AMI APTIOV contains vulnerabilities in BIOS where users may cause  "Out-of-bounds Write by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.	Aptio V
CVE-2025-58772	Oct 13, 2026	AMI APTIOV BIOS Buffer Overflow (CVE-2025-58772) AMI APTIOV contains vulnerabilities in BIOS where users may cause  Classic Buffer Overflow by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.	Aptio V
CVE-2025-58771	Oct 13, 2026	AMI APTIOV BIOS Integer Overflow Vulnerability (Local) AMI APTIOV contains vulnerabilities in BIOS where users may cause Integer Overflow or Wraparound by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.	Aptio V
CVE-2026-33197	Sep 08, 2026	AMI APTIOV BIOS Privileged Local Arbitrary Code Exec AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the Incomplete List of Disallowed Inputs by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability.	Aptio V
CVE-2025-58770	Dec 12, 2025	APTIOV BIOS: Local Permission Escalation via BIOS Vulnerability APTIOV contains a vulnerability in BIOS where a user may cause Improper Handling of Insufficient Permissions or Privileges by local access. Successful exploitation of this vulnerability can lead to escalation of authorization and potentially impact Integrity and Availability.	Aptio V
CVE-2025-33044	Oct 14, 2025	APTIOV BIOS OOB Buffer Overflow (CVE-2025-33044) APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local means. Successful exploitation of this vulnerability may lead to memory corruption and impact Integrity and Availability.	Aptio V
CVE-2025-22833	Oct 14, 2025	APTIOV BIOS GCC Size-Check Bypass (CVE-2025-22833) APTIOV contains a vulnerability in BIOS where an attacker may cause a Buffer Copy without Checking Size of Input by local accessing. Successful exploitation of this vulnerability may lead to arbitrary code execution.	Aptio V
CVE-2025-22832	Oct 14, 2025	APTIO V BIOS OoB Write Vulnerability Enables Local Data Corruption APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability.	Aptio V
CVE-2025-22831	Oct 14, 2025	APTIO V BIOS OOB Write (CVE-2025-22831) APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability.	Aptio V
CVE-2025-33043	May 29, 2025	Improper Input Validation in APTIONV BIOS (CVE-2025-33043) APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exploitation of this vulnerability can potentially impact of integrity.	Aptio V
CVE-2024-54085	Mar 11, 2025	Authentication Bypass via Redfish Host Interface in AMI SPx BMC AMIs SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	Megarac Sp X
CVE-2024-2315	Nov 12, 2024	Local Access Control Bypass in APTIO V BIOS leads to SPI Flash tampering APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Successful exploitation of this vulnerability may lead to unexpected SPI flash modifications and BIOS boot kit launches, also impacting the availability.	Aptio V
CVE-2023-34332	Jan 09, 2024	BMC Untrusted Pointer Dereference in AMI SPx AMIs SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference by a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	Megarac Sp X
CVE-2023-34333	Jan 09, 2024	Amazon AMI SPx BMC Pointer Dereference Vulnerability AMIs SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference via a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	Megarac Sp X
CVE-2023-37293	Jan 09, 2024	AMIS BMC Stack Buffer Overflow (CVE-2023-37293) AMIs SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	Megarac Sp X
CVE-2023-37294	Jan 09, 2024	Heap memory corruption in SPx BMC via network, possible DoS & RCE AMIs SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	Megarac Sp X
CVE-2023-37295	Jan 09, 2024	SPx BMC Heap Corruption via Adjacent Network (CVE-2023-37295) AMIs SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	Megarac Sp X
CVE-2023-37296	Jan 09, 2024	BMC Stack Buffer Corruption in AWS AMI Service Processor (SPx) AMIs SPx contains a vulnerability in the BMC where an Attacker may cause a stack memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	Megarac Sp X
CVE-2023-37297	Jan 09, 2024	Supermicro BMC Heap Corruption via Adjacent Network (CVE-2023-37297) AMIs SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	Megarac Sp X
CVE-2023-3043	Jan 09, 2024	Buffer Overflow in AMI BMC via Adjacent Network (CVE-2023-3043) AMIs SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	Megarac Sp X
CVE-2023-39538	Dec 06, 2023	AMI AptioV BIOS Local BMP Logo Upload Vulnerability (CVE-2023-39538) AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.	Aptio V
CVE-2023-39539	Dec 06, 2023	AMI AptioV BIOS Local PNG Logo Upload Vulnerability AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.	Aptio V
CVE-2023-39535	Nov 14, 2023	AMI AptioV BIOS Improper Input Validation over LAN AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.	Aptio V
CVE-2023-39536	Nov 14, 2023	AMI AptioV BIOS Local Network Input Validation Vulnerability AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.	Aptio V
CVE-2023-39537	Nov 14, 2023	AMI AptioV BIOS Input Validation Flaw Enables Local Exploit AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.	Aptio V
CVE-2023-34469	Sep 12, 2023	AMI AptioV BIOS Improper Network Access Control AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. A successful exploit of this vulnerability may lead to a loss of confidentiality.	Aptio V
CVE-2023-34470	Sep 12, 2023	AMI AptioV BIOS Local Network Improper Access Control AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.	Aptio V
CVE-2023-34329	Jul 18, 2023	HTTP header spoofing auth bypass in AMI MegaRAc AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.	Megarac Sp X
CVE-2023-34330	Jul 18, 2023	AMI SPx BMC Insecure Code Exec via Dynamic Redfish Ext AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.	Megarac Sp X
CVE-2023-34337	Jul 05, 2023	AMI SPx BMC HMAC Key Weakness Enables CnI Loss AMI SPx contains a vulnerability in the BMC where a user may cause an inadequate encryption strength by hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.	Megarac Sp X
CVE-2023-34338	Jul 05, 2023	AMI SPx BMC Hardcoded Crypto Key Vulnerability (CVE-2023-34338) AMI SPx contains a vulnerability in the BMC where an Attacker may cause a use of hard-coded cryptographic key by a hard-coded certificate. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.	Megarac Sp X
CVE-2023-34471	Jul 05, 2023	AMI SPx BMC HMAC Crypto Flaw Exposes Confidentiality, Integrity, Authentication AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to the loss confidentiality, integrity, and authentication.	Megarac Sp X
CVE-2023-34472	Jul 05, 2023	AMI SPx BMC Improper CRLF Neutralization in HTTP Headers AMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A successful exploit of this vulnerability may lead to a loss of integrity.	Megarac Sp X
CVE-2023-34473	Jul 05, 2023	AMI SPx BMC HardCoded Credentials Exploit AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.	Megarac Sp X
CVE-2023-34336	Jun 12, 2023	AMI BMC IPMI Handler Overflow Enables Privilege Escalation AMI BMC contains a vulnerability in the IPMI handler, where an attacker with the required privileges can cause a buffer overflow, which may lead to code execution, denial of service, or escalation of privileges.	Megarac Sp X
CVE-2023-34343	Jun 12, 2023	AMI BMC SPX REST API Command Injection Leading to Remote Code Exec AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, or data tampering.	Megarac Sp X
CVE-2023-34342	Jun 12, 2023	AMI BMC IPMI Arbitrary File Upload/Download (CVE-2023-34342) AMI BMC contains a vulnerability in the IPMI handler, where an attacker can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure, or data tampering.	Megarac Sp X
CVE-2023-34335	Jun 12, 2023	AMI BMC IPMI Handler Enables Unauthorized SPI Flash Write AMI BMC contains a vulnerability in the IPMI handler, where an unauthenticated host is allowed to write to a host SPI flash, bypassing secure boot protections. An exploitation of this vulnerability may lead to a loss of integrity or denial of service.	Megarac Spx
CVE-2023-34334	Jun 12, 2023	AMI BMC SPX REST API Shell Injection Causing RCE AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, or data tampering.	Megarac Sp X
CVE-2023-34344	Jun 12, 2023	AMI BMC IPMI Username Enumeration CVE-2023-34344 AMI BMC contains a vulnerability in the IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid username, which may lead to information disclosure.	Megarac Sp X
CVE-2023-34345	Jun 12, 2023	AMI BMC SPX REST API Arbitrary File Read Vulnerability AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can access arbitrary files, which may lead to information disclosure.	Megarac Sp X
CVE-2023-34341	Jun 12, 2023	AMI BMC SPX REST API PrivEsc + Mem Write for Code Exec AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can read and write to arbitrary locations within the memory context of the IPMI server process, which may lead to code execution, denial of service, information disclosure, or data tampering.	Megarac Sp X
CVE-2023-28863	Apr 18, 2023	AMI MegaRAC Insufficient Data Authenticity Verification AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.	Megarac Sp X
CVE-2023-25192	Feb 15, 2023	User Enumeration via Redfish on AMI MegaRAC SPX (<SPx12-u7/SPx13-u5) AMI MegaRAC SPX devices allow User Enumeration through Redfish. The fixed versions are SPx12-update-7.00 and SPx13-update-5.00.	Megarac Sp X
CVE-2023-25191	Feb 15, 2023	AMI MegaRAC SPX Password Disclosure via Redfish, patch in SPx12-u7.00/SPx13-u5.00 AMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12-update-7.00 and SPx_13-update-5.00.	Megarac Sp X
CVE-2022-40258	Jan 31, 2023	AMI Megarac Weak Password Hashes in Redfish API AMI Megarac Weak password hashes for Redfish & API	Megarac Spx 13 Megarac Spx 12
CVE-2022-26872	Jan 30, 2023	AMI Megarac Password Reset API Interception Vulnerability AMI Megarac Password reset interception via API	Megarac Sp X
CVE-2022-2827	Dec 05, 2022	AMI MegaRAC User Enumeration Vulnerability (CVE-2022-2827) AMI MegaRAC User Enumeration Vulnerability	Megarac Sp X