Lenovo Warns of High-Severity Server Flaw That Restores Default Root Credentials After Reset

Lenovo has disclosed a high-severity security flaw in ThinkSystem V4 server management firmware that restores a default OpenBMC root password after a factory reset.

Tracked as CVE-2026-81936, the issue could let attackers access enabled administrative interfaces and reach the controller’s underlying operating system, which is normally restricted.

The CVE record, published on November 11, 2026, states that Lenovo found the issue during an internal security review. The flaw affects a limited range of XClarity Controller 3 firmware releases, rather than every ThinkSystem server or all products using OpenBMC.

The affected releases run from XCC3 version 2.51, build IHX432Y, through version 2.56, build IHX436K. Lenovo describes the cause as a development regression, meaning a software change reintroduced unsafe behavior. Performing an “XCC Reset to Default” operation on these versions reintroduces the default OpenBMC root credential.

The trigger is specifically a controller reset to defaults. The supplied disclosure does not describe an ordinary server restart, operating system reinstall, or power cycle as causing the problem. This makes firmware version checks and reset history important when assessing exposure.

Lenovo’s XClarity Controller 3 product guide explains that XCC3 is an OpenBMC-based management processor built into ThinkSystem V4 servers. It supports hardware monitoring, firmware updates, remote power control, and several management interfaces. Access to this layer carries significant risk because it controls functions beyond normal server applications.

Lenovo Warns of Server Vulnerability

After the reset restores the credential, an attacker could use it against enabled XCC administrative interfaces. Lenovo also warns that this provides access to the underlying XCC operating system. That is the controller’s operating system, not automatically the host operating system running business workloads.

The issue is classified as CWE-1392, Use of Default Credentials. MITRE describes this weakness as using default passwords or keys for potentially critical functions, making unauthorized access easier if those values remain in use.

The record assigns a CVSS 4.0 score of 7.1, rated high, and a CVSS 3.1 score of 6.8, rated medium. Both vectors require high privileges and user interaction. The disclosure should therefore not be read as evidence of an unrestricted, unauthenticated internet takeover.

Previous reporting on OpenBMC server vulnerabilities and BMC firmware security flaws shows why controller security needs separate attention. Those reports concern different vulnerabilities and do not establish exploitation of this Lenovo issue.

Lenovo says the affected versions are no longer available for download and that it has improved development processes to prevent and detect similar regressions. The supplied record does not name a specific replacement build or report active attacks.

Administrators should identify installed XCC3 builds, review whether affected controllers underwent resets, and confirm the appropriate supported firmware with Lenovo. Keep management access restricted to trusted networks.

Lenovo’s security dashboard can help review enabled services and account settings. However, it should not replace checking the affected firmware range and obtaining vendor guidance before further reset operations.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Lenovo Warns of High-Severity Server Flaw That Restores Default Root Credentials After Reset appeared first on Cyber Security News.