ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Two subcommands "ipmi-oem dell get-active-directory-config" and "ipmi-oem fujitsu get-sel-entry-long-text" were found to have exploitable buffer overflows on response messages.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36211 advisory.

    [1.6.18-1]
    - Update to 1.6.18

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0636 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-50031:
    ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent     Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It     is implemented by a large number of hardware manufacturers to support system management. It is most     commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI)     and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI     OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the     ipmi-oem command to send a request to a server to retrieve specific information. Two subcommands ipmi-oem     dell get-active-directory-config and ipmi-oem fujitsu get-sel-entry-long-text were found to have     exploitable buffer overflows on response messages.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0192 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-50031:
    ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent     Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It     is implemented by a large number of hardware manufacturers to support system management. It is most     commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI)     and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI     OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the     ipmi-oem command to send a request to a server to retrieve specific information. Two subcommands ipmi-oem     dell get-active-directory-config and ipmi-oem fujitsu get-sel-entry-long-text were found to have     exploitable buffer overflows on response messages.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:36211 advisory.

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39006 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39010 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39007 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39008 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36211 advisory.

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36210 advisory.

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1225:03 advisory.

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:36210 advisory.

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:36307 advisory.

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36307 advisory.

    [1.6.18-1]
    - Update to 1.6.18, fixes CVE-2026-50031

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36307 advisory.

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36210 advisory.

    [1.6.18-1]
    - Update to 1.6.18, fixes CVE-2026-50031

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:36211 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:36210 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:36307 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2679-1 advisory.

    This update for freeipmi fixes the following issue

    - CVE-2026-50031: denial of service via buffer overflow in ipmi-oem client (bsc#1267605).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent     Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It     is implemented by a large number of hardware manufacturers to support system management. It is most     commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI)     and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI     OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the     ipmi-oem command to send a request to a server to retrieve specific information. Two subcommands ipmi-oem     dell get-active-directory-config and ipmi-oem fujitsu get-sel-entry-long-text were found to have     exploitable buffer overflows on response messages. (CVE-2026-50031)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
328748	Oracle Linux 10 : freeipmi (ELSA-2026-36211)	Nessus	Oracle Linux Local Security Checks	high
328395	TencentOS Server 3: freeipmi (TSSA-2026:0636)	Nessus	Tencent Local Security Checks	high
327259	Alibaba Cloud Linux 3 : 0192: freeipmi (ALINUX3-SA-2026:0192)	Nessus	Alibaba Cloud Linux Local Security Checks	high
326523	AlmaLinux 10 : freeipmi (ALSA-2026:36211)	Nessus	Alma Linux Local Security Checks	high
326516	RHEL 9 : freeipmi (RHSA-2026:39006)	Nessus	Red Hat Local Security Checks	high
326514	RHEL 9 : freeipmi (RHSA-2026:39010)	Nessus	Red Hat Local Security Checks	high
326513	RHEL 10 : freeipmi (RHSA-2026:39007)	Nessus	Red Hat Local Security Checks	high
326510	RHEL 9 : freeipmi (RHSA-2026:39008)	Nessus	Red Hat Local Security Checks	high
326500	RockyLinux 10 : freeipmi (RLSA-2026:36211)	Nessus	Rocky Linux Local Security Checks	high
326499	RockyLinux 9 : freeipmi (RLSA-2026:36210)	Nessus	Rocky Linux Local Security Checks	high
325869	MiracleLinux 8 : freeipmi-1.6.18-1.el8_10 (AXSA:2026-1225:03)	Nessus	Miracle Linux Local Security Checks	high
325768	AlmaLinux 9 : freeipmi (ALSA-2026:36210)	Nessus	Alma Linux Local Security Checks	high
325767	AlmaLinux 8 : freeipmi (ALSA-2026:36307)	Nessus	Alma Linux Local Security Checks	high
325592	Oracle Linux 8 : freeipmi (ELSA-2026-36307)	Nessus	Oracle Linux Local Security Checks	high
325555	RockyLinux 8 : freeipmi (RLSA-2026:36307)	Nessus	Rocky Linux Local Security Checks	high
325533	Oracle Linux 9 : freeipmi (ELSA-2026-36210)	Nessus	Oracle Linux Local Security Checks	high
325529	RHEL 10 : freeipmi (RHSA-2026:36211)	Nessus	Red Hat Local Security Checks	high
325517	RHEL 9 : freeipmi (RHSA-2026:36210)	Nessus	Red Hat Local Security Checks	high
325478	RHEL 8 : freeipmi (RHSA-2026:36307)	Nessus	Red Hat Local Security Checks	high
323885	SUSE SLES12: freeipmi / freeipmi-devel / libfreeipmi17 / libipmiconsole2 / etc (SUSE-SU-2026:2679-1)	Nessus	SuSE Local Security Checks	high
318377	Linux Distros Unpatched Vulnerability : CVE-2026-50031	Nessus	Misc.	high

Detections

Analytics

CVE-2026-50031

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high