Lenovo ThinkSystem V4 XCC3 Firmware Restores Default OpenBMC Root Credentials After Reset to Default (CVE-2026-81936)

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6059 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-81936 XCC Account Creation or Credential Change (TL-2026-6059)

Detects new local accounts, password changes or SSH authorized_keys modifications on XCC3 / OpenBMC controllers. After root access via the default credential from CVE-2026-81936, an attacker would create backdoor accounts or change credentials to retain access.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1098, T1136.001, T1078.001
• Data sources: index=infra_bmc sourcetype=syslog, Sentinel Syslog table, openbmc/syslog Sigma logsource
• Severity: high
• Confidence: medium

Splunk SPL

index=infra_bmc sourcetype=syslog earliest=-24h ("XCC" OR "XClarity" OR "OpenBMC") | regex _raw="(?i)(user (created|added)|new user|account (created|added|modified)|password (changed|set|reset)|useradd|adduser|authorized_keys|AccountService/Accounts)" | search NOT "Reset to Default" | stats count min(_time) AS first_seen max(_time) AS last_seen BY host | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | table host count first_seen last_seen

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("XCC", "XClarity", "OpenBMC")
| where SyslogMessage matches regex @"(?i)(user (created|added)|new user|account (created|added|modified)|password (changed|set|reset)|useradd|adduser|authorized_keys|AccountService/Accounts)"
| where SyslogMessage !has "Reset to Default"
| project TimeGenerated, HostName, ProcessName, SyslogMessage

Sigma

title: XCC Local Account or Credential Change After Root Access (CVE-2026-81936)
id: 3f6a1c52-7b0e-4d21-9a4e-60590000a006
status: experimental
description: Detects creation of local accounts, password changes or SSH key additions on a Lenovo XCC3 / OpenBMC controller, a persistence step after authenticating with the restored default root credential.
references:
    - https://www.cve.org/CVERecord?id=CVE-2026-81936
    - https://nvd.nist.gov/vuln/detail/CVE-2026-81936
author: Threadlinqs Team
date: 2026-11-14
tags:
    - cve.2026.81936
    - attack.persistence
    - attack.t1078.001
    - attack.t1098
    - attack.t1136.001
logsource:
    product: openbmc
    service: syslog
detection:
    selection:
        Message|contains:
            - 'user created'
            - 'user added'
            - 'new user'
            - 'password changed'
            - 'useradd'
            - 'authorized_keys'
    condition: selection
falsepositives:
    - Routine administrator account management
    - Provisioning automation
level: high

Known false positives:

• Planned onboarding of BMC administrator accounts
• Automated provisioning tools that rotate the BMC root password

Tuning notes: Exclude known provisioning service accounts and change windows. Raise severity when the change occurs within 24 hours of an XCC Reset to Default or a root login from a non-jump host.

• 🔒 CVE-2026-81936 XCC Root Login From Non-Jump-Host Source (TL-2026-6059) · unlock with TL Creds
• 🔒 CVE-2026-81936 Root Shell Activity on XCC OpenBMC OS (TL-2026-6059) · unlock with TL Creds
• 🔒 CVE-2026-81936 XCC BMC Outbound Connection to External Address (TL-2026-6059) · unlock with TL Creds
• 🔒 CVE-2026-81936 XCC Reset to Default Operation (TL-2026-6059) · unlock with TL Creds
• 🔒 CVE-2026-81936 Redfish Root Session or Account Change on XCC (TL-2026-6059) · unlock with TL Creds
• 🔒 CVE-2026-81936 BMC-to-BMC SSH or IPMI Lateral Movement (TL-2026-6059) · unlock with TL Creds
• 🔒 CVE-2026-81936 XCC Reset to Default Followed by Root Login (TL-2026-6059) · unlock with TL Creds
• 🔒 CVE-2026-81936 XCC Management Port Access From Non-Jump Host (TL-2026-6059) · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-6059.

Technical analysis

Lenovo found the issue in an internal security review; no active exploitation or public PoC is reported.

CVE-2026-81936 is a development regression in the XClarity Controller 3 (XCC3) firmware of Lenovo ThinkSystem V4 servers. XCC3 is Lenovo's OpenBMC-based baseboard management controller (ASPEED AST2600 BMC per Lenovo Press documentation). According to the CVE record, firmware versions 2.51 (build IHX432Y) through 2.56 (build IHX436K) re-introduce the default OpenBMC root password when an 'XCC Reset to Default' operation is performed. The weakness is classified as CWE-1392 (Use of Default Credentials).

An attacker who can reach an enabled XCC administrative interface and who knows or can obtain the default OpenBMC root credential could authenticate with it and gain access to the XCC's underlying operating system, which is normally not accessible. This is access to the management controller, not automatically to the host operating system, but a BMC foothold is a high-value position because the controller operates out-of-band from the host OS and its security tooling. Lenovo Press documents XCC3 interfaces including a web UI, SSH CLI, Redfish and REST APIs, IPMI 2.0, SNMP and CIM-XML; the sources do not specify which of these accept the restored credential.

Scoring: CVSS 4.0 base 7.1 (High), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; CVSS 3.1 base 6.8 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. Both require high privileges and user interaction, because the vulnerable state is only created when someone performs a Reset to Default. Rapid7 lists EPSS at 0% and the CVE is not in CISA KEV.

The issue was found by Lenovo in an internal security review. The affected firmware versions are no longer available for download, and Lenovo states it has made process enhancements to prevent and identify similar regressions. The public sources reviewed name no fixed or replacement build and no vendor workaround. No public PoC, active exploitation, threat actor attribution or network IOCs are reported. Defenders should inventory XCC3 firmware, determine whether affected controllers have been reset to defaults, restrict XCC management interfaces to trusted management networks, and obtain Lenovo guidance before further reset operations.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.004 SSH

Initial Access

T1078.001 Default Accounts; T1133 External Remote Services

Persistence

T1078.001 Default Accounts; T1133 External Remote Services

Privilege Escalation

T1078.001 Default Accounts

Defense Evasion

T1078.001 Default Accounts

Remediation

Patches

• Lenovo has withdrawn the affected XCC3 builds from download; confirm the supported replacement firmware with Lenovo (no fixed build is named in the public sources reviewed)

Immediate actions

• Inventory ThinkSystem V4 servers and identify XCC3 firmware versions 2.51 (IHX432Y) through 2.56 (IHX436K)
• Determine whether affected XCCs have been reset to defaults (XCC Reset to Default) and treat any such controller as potentially exposed to the default OpenBMC root credential
• Restrict XCC management interfaces (web, SSH, Redfish, IPMI) to dedicated, trusted out-of-band management networks
• Obtain Lenovo guidance before performing further XCC Reset to Default operations on affected firmware

Workarounds

• No vendor workaround is published in the sources reviewed; limit exposure by restricting access to enabled XCC administrative interfaces

Longer-term hardening

• Keep BMC management networks isolated from user and internet-facing networks
• Monitor XCC authentication events and Security Dashboard user-account warnings
• Add BMC firmware version and post-reset credential validation to server provisioning and decommissioning checklists

Affected and fixed versions

• Lenovo — ThinkSystem V4 XClarity Controller 3 (XCC3) firmware
  Vulnerable versions: 2.51 (IHX432Y) through 2.56 (IHX436K)

Timeline

• 2026-08-27 CVE-2026-81936 identifier reserved (per OpenCVE record).
• 2026-11-11 NVD publishes CVE-2026-81936 with CVSS 4.0 7.1 (High) and CVSS 3.1 6.8 (Medium).
• 2026-11-11 CVE-2026-81936 published in the CVE record; Lenovo describes a development regression in XCC3 2.51 (IHX432Y) through 2.56 (IHX436K) that re-introduces the default OpenBMC root password on XCC Reset to Default, found in an internal security review.
• 2026-11-12 Cyber Security News reports the flaw, noting the affected firmware versions are no longer available for download and no active exploitation is reported.
• 2026-11-12 NVD record last modified (per OpenCVE).
• 2026-11-13 CVE first appears in the OpenCVE feed; Rapid7 lists EPSS 0% and no CISA KEV listing.

Sources cited

• CVE-2026-81936 CVE Record CVE Program · Advisory · 2026-11-11
• NVD - CVE-2026-81936 NVD (NIST) · Advisory · 2026-11-11
• OpenCVE - CVE-2026-81936 app.opencve.io · Research · 2026-11-13
• Rapid7 Vulnerability Database - CVE-2026-81936 Rapid7 · Research · 2026-11-11
• Lenovo XClarity Controller 3 (XCC3) Product Guide (Lenovo Press LP2273) lenovopress.lenovo.com · Vendor report · 2026-08-18
• CWE-1392: Use of Default Credentials MITRE · Research
• Lenovo Warns of High-Severity Server Flaw That Restores Default Root Credentials After Reset cybersecuritynews.com · News · 2026-11-12

More in vulnerability

• FreeRDP client-side RCE chain (CVE-2026-91964 heap overflow + CVE-2026-91963 USB redirection heap disclosure) found via AI-agent vulnerability research workflow
• Ivanti EPM Core Critical SQL Injection Enabling Unauthenticated RCE (CVE-2026-121653) and Multiple Ivanti CSA/EPMM/Sentry/UWM Flaws
• UnrealIRCd labeled-response IRCv3 label tag injection (CVE-2026-114713) exploited in the wild
• LiteLLM semantic cache tenant isolation bypass (CVE-2026-89032)
• PTC Windchill and FlexPLM Critical RCE via Deserialization of Untrusted Data (CVE-2026-126325)

Previous and next in vulnerability

• CVE-2026-25196: OS Command Injection in Copeland XWEB Pro (1.12.1 and prior) via Wi-Fi SSID/Password Fields Previous report
• CISA adds Check Point Gaia DynamicCLI LPE (CVE-2026-123039) and UnrealIRCd labeled-response command injection (CVE-2026-114713) to KEV Next report