CVE-2026-81936

Name of the Vulnerable Software and Affected Versions ThinkSystem v4 XClarity Controller 3 (XCC3) versions 2.51 through 2.56

Description A development regression occurs when performing an XCC Reset to Default operation, which re-introduces the default OpenBMC root password. This allows an attacker to gain access to enabled administrative interfaces and the underlying XCC Operating System, which is typically inaccessible.

Recommendations Update ThinkSystem v4 XClarity Controller 3 (XCC3) versions 2.51 through 2.56 to a newer build. Restrict access to administrative interfaces to minimize the risk of unauthorized access.