36,000 Servers Are Leaking Admin Password Hashes Before Anyone Even Logs In

There’s a second, more privileged computer hiding inside almost every server on Earth — one your antivirus can’t see and your firewall usually doesn’t watch. Researchers just found tens of thousands of them handing out password data to anyone who asks, before any login even happens.

What Researchers Actually Found

On May 6, 2026, researchers at security firm Lava used the internet-scanning tool Shodan to enumerate every server on the public internet responding on UDP port 623 — the network port used by a protocol called IPMI, which should never be reachable from the open internet in the first place. The scan returned 36,872 exposed hosts.

Of those, 24,650 — roughly two-thirds — handed back password-derived authentication data before the requester had actually logged in. No credentials required. No exploit needed. Just a request to the right port, answered by a design flaw that’s been publicly documented since 2013.

What a BMC Actually Is

Most people who’ve never worked in IT have no reason to know this exists: nearly every server built in the last two decades has a second, entirely separate computer soldered onto its motherboard. It’s called a Baseboard Management Controller, or BMC — its own processor, its own memory, its own network connection, running independently of the server’s main operating system. Its job is to let administrators remotely power a server on or off, reinstall its operating system, update firmware, or check hardware health, even if the main system has crashed, frozen, or is switched off entirely.

That’s a real convenience for anyone managing racks of servers in a data centre they aren’t physically standing next to. It’s also, structurally, one of the most privileged single points of access in any data centre — and the security industry has known this for over a decade.

A technical walkthrough of BMC security and how to investigate this attack surface directly. Independent production, not affiliated with Wangdoo.

Why Your Antivirus Can’t See This

This is the detail that makes BMC exposure categorically different from most server security issues. A BMC doesn’t run inside the server’s operating system — it sits beside it, on its own separate chip, watching and controlling the hardware from outside. That means every security tool built to monitor what’s happening inside an operating system — endpoint detection and response software, intrusion detection systems, anti-malware suites, even hardware-level trusted platform module attestation — has no visibility into it whatsoever.

How the Actual Flaw Works

The specific weakness Lava’s scan exploited is tracked as CVE-2013-4786 — a flaw in the authentication handshake used by IPMI 2.0, a protocol originally introduced in 2004. IPMI’s authentication process is supposed to work as a mutual handshake: both the client and the server prove their identity to each other before access is granted. The flaw sits in the sequencing of that handshake — a vulnerable BMC will hand back a cryptographic response derived from the account’s password before the login process has actually completed.

That response — an HMAC-SHA1 hash — doesn’t hand over the plaintext password directly. But it gives an attacker everything needed to test password guesses offline, on their own hardware, without ever having to contact the target server again or risk triggering a lockout. Lava’s own testing showed just how fast that process can be in practice: HPE iLO factory-default passwords were recoverable in under a minute on modern GPU hardware, and Supermicro passwords — despite being uniquely generated per server rather than shared — were cracked in roughly an hour.

This Isn’t Theoretical — and It’s Getting Worse, Not Better

Lava’s report notes it found evidence consistent with real-world exploitation of exposed BMCs, not just a theoretical exposure. And the population of vulnerable systems isn’t shrinking. Between May and July 2026, Lava tracked an average of roughly 60 previously unseen IP addresses newly exposing IPMI to the internet every single day — servers being deployed or reconfigured without anyone closing this specific door, faster than existing exposed systems are being locked down.

More than 30% of the captured password hashes were recoverable using nothing more exotic than common password wordlists combined with the predictable, documented default-password patterns printed on many vendors’ chassis stickers. Separately, 6,240 of the exposed hosts accepted a completely empty username during authentication — a configuration that shouldn’t be internet-facing under any circumstance, let alone still be common in 2026.

What Vendors Are Actually Doing About It

Lava notified Supermicro about its findings in June 2026. According to reporting on the disclosure, Supermicro acknowledged the risk and pointed to its existing guidance recommending administrators rotate default BMC passwords and isolate management networks — and said it would evaluate potential improvements to default password policy for future hardware revisions. That’s a fairly standard vendor response to a protocol-level flaw: the underlying weakness lives in the IPMI 2.0 specification itself, not in any single company’s implementation of it, which limits how much a single patch from a single vendor can actually fix.

My Take — Mr Wangdoo

What strikes me most about this story isn’t the exposure count — large internet-scan numbers like “36,872 exposed hosts” are common in security research and can start to feel abstract after you’ve read a few of them. It’s the thirteen-year gap between when this specific flaw was documented and when a straightforward internet scan still finds two-thirds of exposed systems vulnerable to it. That’s not a zero-day. Nobody needed to discover anything new to build this scan — the vulnerability has had a CVE number, a description, and known mitigations since 2013. The gap here isn’t in knowledge. It’s in whether anyone acted on knowledge that’s been publicly available for over a decade.

I think the “your security tools can’t see this” point is the one worth sitting with longest, because it reframes what the actual failure is. This isn’t primarily a story about a clever new attack technique. It’s a story about a category of infrastructure that sits structurally outside the boundary most organisations’ security programmes were built to cover. Endpoint tools watch the operating system. Network tools watch traffic between systems. A BMC exists specifically to operate independently of the operating system it manages — which is exactly what makes it useful for legitimate administration, and exactly why standard defensive tooling was never going to catch a compromise happening there. It’s the same underlying theme running through our coverage of Januscape, the 16-year-old KVM flaw — the parts of a system that operate below the layer most defensive tooling was built to watch tend to accumulate risk quietly, for years, precisely because nobody’s regular review process reaches that far down.

The practical fix here is almost anticlimactic given how serious the exposure is: none of Lava’s recommendations require new technology or a vendor patch. Blocking a port, rotating a default password, and isolating a management network are the kind of unglamorous, well-understood configuration hygiene that’s been recommended for over a decade. The fact that tens of thousands of internet-facing servers still haven’t done it says less about the difficulty of the fix and more about how easily infrastructure that “just works” quietly falls outside anyone’s regular review cycle.

Frequently Asked Questions

Clayton Samuel (Mr Wangdoo), QFA

Founder and editor, Wangdoo.com. Qualified Financial Adviser with a background in electronics, web development, and cloud infrastructure. This article is based on the original security researchers’ disclosure and independent technical reporting. No interviews were conducted; no product is promoted.