BMC vulnerability