# Lenovo ThinkSystem V4 XCC3 Firmware Restores Default OpenBMC Root Credentials After Reset to Default (CVE-2026-81936)

> Lenovo disclosed CVE-2026-81936 (CWE-1392, Use of Default Credentials) in XClarity Controller 3 (XCC3) firmware on ThinkSystem V4 servers, versions 2.51 (IHX432Y) through 2.56 (IHX436K). An 'XCC Reset to Default' operation re-introduces the default OpenBMC root password, which could let an attacker reach enabled XCC administrative interfaces and the controller's underlying operating system. Lenovo found the issue in an internal security review; no active exploitation or public PoC is reported.

- **Published:** 2026-11-14T08:55:14Z
- **Last reviewed:** 2026-11-14T08:55:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6059
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6059.png
- **ID:** TL-2026-6059
- **Severity:** HIGH (CVSS 7.1)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 8
- **CVEs:** CVE-2026-81936

## Description

CVE-2026-81936 is a development regression in the XClarity Controller 3 (XCC3) firmware of Lenovo ThinkSystem V4 servers. XCC3 is Lenovo's OpenBMC-based baseboard management controller (ASPEED AST2600 BMC per Lenovo Press documentation). According to the CVE record, firmware versions 2.51 (build IHX432Y) through 2.56 (build IHX436K) re-introduce the default OpenBMC root password when an 'XCC Reset to Default' operation is performed. The weakness is classified as CWE-1392 (Use of Default Credentials).

An attacker who can reach an enabled XCC administrative interface and who knows or can obtain the default OpenBMC root credential could authenticate with it and gain access to the XCC's underlying operating system, which is normally not accessible. This is access to the management controller, not automatically to the host operating system, but a BMC foothold is a high-value position because the controller operates out-of-band from the host OS and its security tooling. Lenovo Press documents XCC3 interfaces including a web UI, SSH CLI, Redfish and REST APIs, IPMI 2.0, SNMP and CIM-XML; the sources do not specify which of these accept the restored credential.

Scoring: CVSS 4.0 base 7.1 (High), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; CVSS 3.1 base 6.8 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. Both require high privileges and user interaction, because the vulnerable state is only created when someone performs a Reset to Default. Rapid7 lists EPSS at 0% and the CVE is not in CISA KEV.

The issue was found by Lenovo in an internal security review. The affected firmware versions are no longer available for download, and Lenovo states it has made process enhancements to prevent and identify similar regressions. The public sources reviewed name no fixed or replacement build and no vendor workaround. No public PoC, active exploitation, threat actor attribution or network IOCs are reported. Defenders should inventory XCC3 firmware, determine whether affected controllers have been reset to defaults, restrict XCC management interfaces to trusted management networks, and obtain Lenovo guidance before further reset operations.

## MITRE ATT&CK

- T1078.001 Default Accounts
- T1078.001 Default Accounts
- T1078.001 Default Accounts
- T1078.001 Default Accounts
- T1133 External Remote Services
- T1133 External Remote Services
- T1021.004 SSH

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-81936 XCC Account Creation or Credential Change (TL-2026-6059)** (`TL-2026-6059-SPL-002`)

Detects new local accounts, password changes or SSH authorized_keys modifications on XCC3 / OpenBMC controllers. After root access via the default credential from CVE-2026-81936, an attacker would create backdoor accounts or change credentials to retain access.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1098, T1136.001, T1078.001
- **Data sources:** index=infra_bmc sourcetype=syslog, Sentinel Syslog table, openbmc/syslog Sigma logsource
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=infra_bmc sourcetype=syslog earliest=-24h ("XCC" OR "XClarity" OR "OpenBMC") | regex _raw="(?i)(user (created|added)|new user|account (created|added|modified)|password (changed|set|reset)|useradd|adduser|authorized_keys|AccountService/Accounts)" | search NOT "Reset to Default" | stats count min(_time) AS first_seen max(_time) AS last_seen BY host | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | table host count first_seen last_seen
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("XCC", "XClarity", "OpenBMC")
| where SyslogMessage matches regex @"(?i)(user (created|added)|new user|account (created|added|modified)|password (changed|set|reset)|useradd|adduser|authorized_keys|AccountService/Accounts)"
| where SyslogMessage !has "Reset to Default"
| project TimeGenerated, HostName, ProcessName, SyslogMessage
```

### Sigma

```yaml
title: XCC Local Account or Credential Change After Root Access (CVE-2026-81936)
id: 3f6a1c52-7b0e-4d21-9a4e-60590000a006
status: experimental
description: Detects creation of local accounts, password changes or SSH key additions on a Lenovo XCC3 / OpenBMC controller, a persistence step after authenticating with the restored default root credential.
references:
    - https://www.cve.org/CVERecord?id=CVE-2026-81936
    - https://nvd.nist.gov/vuln/detail/CVE-2026-81936
author: Threadlinqs Team
date: 2026-11-14
tags:
    - cve.2026.81936
    - attack.persistence
    - attack.t1078.001
    - attack.t1098
    - attack.t1136.001
logsource:
    product: openbmc
    service: syslog
detection:
    selection:
        Message|contains:
            - 'user created'
            - 'user added'
            - 'new user'
            - 'password changed'
            - 'useradd'
            - 'authorized_keys'
    condition: selection
falsepositives:
    - Routine administrator account management
    - Provisioning automation
level: high

```

**Known false positives:**

- Planned onboarding of BMC administrator accounts
- Automated provisioning tools that rotate the BMC root password

**Tuning notes:** Exclude known provisioning service accounts and change windows. Raise severity when the change occurs within 24 hours of an XCC Reset to Default or a root login from a non-jump host.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-81936 XCC Root Login From Non-Jump-Host Source (TL-2026-6059) (locked: unlock with TL Creds)
- CVE-2026-81936 Root Shell Activity on XCC OpenBMC OS (TL-2026-6059) (locked: unlock with TL Creds)
- CVE-2026-81936 XCC BMC Outbound Connection to External Address (TL-2026-6059) (locked: unlock with TL Creds)
- CVE-2026-81936 XCC Reset to Default Operation (TL-2026-6059) (locked: unlock with TL Creds)
- CVE-2026-81936 Redfish Root Session or Account Change on XCC (TL-2026-6059) (locked: unlock with TL Creds)
- CVE-2026-81936 BMC-to-BMC SSH or IPMI Lateral Movement (TL-2026-6059) (locked: unlock with TL Creds)
- CVE-2026-81936 XCC Reset to Default Followed by Root Login (TL-2026-6059) (locked: unlock with TL Creds)
- CVE-2026-81936 XCC Management Port Access From Non-Jump Host (TL-2026-6059) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Lenovo Warns of High-Severity Server Flaw That Restores Default Root Credentials After Reset](https://cybersecuritynews.com/lenovo-server-flaw/)
- [CVE-2026-81936 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-81936)
- [NVD - CVE-2026-81936](https://nvd.nist.gov/vuln/detail/CVE-2026-81936)
- [OpenCVE - CVE-2026-81936](https://app.opencve.io/cve/CVE-2026-81936)
- [Rapid7 Vulnerability Database - CVE-2026-81936](https://www.rapid7.com/db/vulnerabilities/cve-2026-81936/)
- [Lenovo XClarity Controller 3 (XCC3) Product Guide (Lenovo Press LP2273)](https://lenovopress.lenovo.com/lp2273-lenovo-xclarity-controller-3-xcc3)
- [CWE-1392: Use of Default Credentials](https://cwe.mitre.org/data/definitions/1392.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6059