# Critical security flaw in server motherboards Thousands of servers vulnerable to remote takeover. - **Source:** [Ars Technica - All content](https://brifing.si/source/b728770c-8dda-457a-8986-84879c9fc42c) - **Published:** 2026-08-05 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/54fa0b79-e92d-4a65-8bde-6bddbd20b9f0 ## Critical server security vulnerability Critical security vulnerabilities have been discovered in thousands of devices from the world's largest server manufacturers. These flaws reside in Baseboard Management Controller (BMC) components embedded deep within server motherboards, some existing for over a decade. BMCs are used to monitor and manage the physical status of servers. ## What is BMC? Baseboard Management Controllers are miniature computers embedded in server motherboards. They operate with their own operating systems, network stacks, and IP addresses. They can function even when servers are powered off or unresponsive, a feature known as 'lights out' and 'out-of-band' management. Administrators use BMCs to reboot servers, install updates, and reinstall operating systems. ## IPMI protocol risk Researchers have been warning about security flaws in the Intelligent Platform Management Interface (IPMI) protocol used by BMCs since 2013. These vulnerabilities allow attackers to execute remote code and take over servers. IPMI is a critical protocol that enables BMCs to operate independently from servers. ## Major threat to data centers BMCs present a golden opportunity for hackers seeking deep, persistent access to data centers. These controllers are often under-monitored and rarely patched, creating what researchers call a 'pervasive, under-monitored, under-patched parallel attack surface' for data center infrastructure. ## Remote code execution risk Attackers exploiting these vulnerabilities can execute remote code on BMCs and gain control over managed servers. Such attacks often create hard-to-detect threats that can persist for long periods. The high privilege level provided by BMCs allows attackers to control entire server infrastructures. ## Decade-old security issues Some BMC security flaws have persisted for over 10 years, exposing vulnerabilities in the server hardware supply chain. Manufacturers appear to have inadequately secured these embedded system components, leaving critical infrastructure at risk. ## Industry response Major server manufacturers have yet to announce comprehensive patching strategies for these vulnerabilities. Experts are urging data center operators to update their BMCs and tighten access controls. Critical infrastructure operators in particular need to take this threat seriously. ## Recommended mitigation steps Organizations should run BMCs on isolated networks, enforce strict access controls, and apply regular security updates. Encrypting IPMI traffic and changing default credentials are among critical measures. Long-term, server manufacturers need to adopt security-first approaches in BMC design. ## Sources covering this story - https://arstechnica.com/security/2026/08/thousands-of-servers-can-be-backdoored-by-exploiting-buggy-motherboard-controllers/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._