CVE-2026-81936 Default OpenBMC Root Credential Reintroduced After Reset to Defaults in ThinkSystem v4 XCC3

An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 XCC3 versions 2.51 IHX432Y to 2.56 IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation. An attacker can gain access to enabled...

CVE-2026-81936

ThinkSystem v4 XClarity Controller 3 (XCC3) versions (2.51) IHX432Y through (2.56) IHX436K are affected by a development regression that re-introduces the default OpenBMC root password when a "Reset to Default" operation is performed. This vulnerability allows an attacker to gain access to enable...

CVE-2026-81936: Lenovo XClarity Controller: An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3)…

An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 XCC3 versions 2.51 IHX432Y to 2.56 IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation. An attacker can gain access to enabled...

PT-2026-145481

Name of the Vulnerable Software and Affected Versions ThinkSystem v4 XClarity Controller 3 XCC3 versions 2.51 through 2.56 Description A development regression occurs when performing an XCC Reset to Default operation, which re-introduces the default OpenBMC root password. This allows an attacker ...