{"metadata": {"vulnerability": "CVE-2026-81936", "count": 18, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 10}, "linked_omitted": 0}, "data": [{"timestamp": "2026-08-27T19:23:16.511Z", "date_only": false, "value": "2026-08-27T19:23:16.511Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-81936", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3902", "record": "WID-SEC-W-2026-3902", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3902", "record": "WID-SEC-W-2026-3902", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3902", "record": "WID-SEC-W-2026-3902", "field": "vulnerabilities.0.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T21:13:17.524Z", "date_only": false, "value": "2026-11-11T21:13:17.524Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-81936", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T21:13:17.524Z", "date_only": false, "value": "2026-11-11T21:13:17.524Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-81936", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-11T21:13:17.524Z", "date_only": false, "value": "2026-11-11T21:13:17.524Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / lenovo", "record": "CVE-2026-81936", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-11T21:32:06.055Z", "date_only": false, "value": "2026-11-11T21:32:06.055510Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117599943106827606", "record": "CVE-2026-81936", "field": "creation_timestamp", "uuid": "81ee3c45-45f2-4d3e-9e31-869a75da4d6b", "content": "CVE-2026-81936 Default OpenBMC Root Credential Reintroduced After Reset to Defaults in ThinkSystem v4 XCC3 An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versions (2.51) IHX432Y to (2.56) IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation.  An attacker can gain access to enabled administrative interfaces of XCC using the default OpenBMC credential re-introduced after Reset to Default. Additionally, this provides access to the underlying XCC Operating System which is not normally accessible. Only these versions are affected and are no longer available for download. Process enhancements have also been made to prevent and identify potential future regression.\nhttps://www.cve.org/CVERecord?id=CVE-2026-81936https://lenovopress.lenovo.com/lp2273-lenovo-xclarity-controller-3-xcc3#Lenovo #XClarityController#CVE_2026_81936#bot", "url": "https://infosec.exchange/users/cve/statuses/117599943106827606"}, {"timestamp": "2026-11-11T22:17:30Z", "date_only": false, "value": "2026-11-11T22:17:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M9M9-M43W-4V64", "record": "GHSA-M9M9-M43W-4V64", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-11T22:17:30.877Z", "date_only": false, "value": "2026-11-11T22:17:30.877", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-81936", "record": "FKIE_CVE-2026-81936", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T23:00:00Z", "date_only": false, "value": "2026-11-11T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3902", "record": "WID-SEC-W-2026-3902", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-11T23:00:00Z", "date_only": false, "value": "2026-11-11T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3902", "record": "WID-SEC-W-2026-3902", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-12T00:33:01Z", "date_only": false, "value": "2026-11-12T00:33:01Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M9M9-M43W-4V64", "record": "GHSA-M9M9-M43W-4V64", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T00:33:01Z", "date_only": false, "value": "2026-11-12T00:33:01Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M9M9-M43W-4V64", "record": "GHSA-M9M9-M43W-4V64", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T09:18:49.346Z", "date_only": false, "value": "2026-11-12T09:18:49.346+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3902", "record": "WID-SEC-W-2026-3902", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-12T10:13:40.443Z", "date_only": false, "value": "2026-11-12T10:13:40.443827Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/intcyberdigest.bsky.social/post/3n24acfvl4w2d", "record": "CVE-2026-81936", "field": "creation_timestamp", "uuid": "e32fbcf5-c73b-4f4c-a54f-b870334f4ccc", "content": "Lenovo caught CVE-2026-81936 itself and pulled versions 2.51 to 2.56. No attacks have been reported.", "url": "https://bsky.app/profile/intcyberdigest.bsky.social/post/3n24acfvl4w2d"}, {"timestamp": "2026-11-12T14:19:08.990Z", "date_only": false, "value": "2026-11-12T14:19:08.990657Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3n24nzdv72h2s", "record": "CVE-2026-81936", "field": "creation_timestamp", "uuid": "fc30c4f3-9ab4-412a-a82a-64df386eb8f3", "content": "Critical flaw in Lenovo ThinkSystem V4: reset to defaults restores OpenBMC root password on XCC3 firmware\u2014tighten access now. #Lenovo #ServerSecurity #FirmwareFlaw #CVE-2026-81936 #OpenBMC #TechNews https://thedailytechfeed.com/lenovo-fixes-high-severity-backdoor-in-thinksystem-v4-servers/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3n24nzdv72h2s"}, {"timestamp": "2026-11-12T22:09:39.233Z", "date_only": false, "value": "2026-11-12T22:09:39.233", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-81936", "record": "FKIE_CVE-2026-81936", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-14T02:44:49.211Z", "anchors": {"origin": {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3902", "record": "WID-SEC-W-2026-3902", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3902", "record": "WID-SEC-W-2026-3902", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2695489.211935, "hours": 748.7470033152778, "days": 31.19779180480324, "min_seconds": 2695489.211935, "max_seconds": 2695489.211935, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-13T22:00:00Z", "date_only": false, "value": "2026-10-13T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-3902", "record": "WID-SEC-W-2026-3902", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-14T02:44:49.211Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}