There is another computer inside your server, and 36,872 of them are on the internet
A scan published on 29 July 2026 found 36,872 management controllers (BMCs) listening on the internet over UDP/623, and 24,650 of them hand out material derived from the account password before anyone logs in. This is not a new CVE: it is CVE-2013-4786, a flaw in the IPMI 2.0 specification itself, dating from 2004, which Dell acknowledges has no patch. The numbers, why a factory password falls in between 32 seconds and one hour, why your EDR will not see it and the six steps to close the management plane of your hardware.