CVE-2026-65199 Huawei openUBMC low-privilege SNMP to administrator privilege escalation
Low-privilege SNMP users can escalate to administrator privileges in Huawei openUBMC due to incorrect privilege assignment for pseudo-identities.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-65199?
CVE-2026-65199 is a medium-severity vulnerability in Huawei openBMC, published on 13 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.
Weakness: CWE-266
Which versions are affected by CVE-2026-65199?
How do I fix CVE-2026-65199?
No fix has been published for CVE-2026-65199 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-65199 being exploited?
There is no known exploitation of CVE-2026-65199 in the wild and no public exploit code.
Sources
Also known as GHSA-246r-j53h-wrm2.