CVE-2026-16793

Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator

State: Published
Severity: 8.7 High
Published: Aug 4, 2026
Updated: Aug 5, 2026
Reserved: Jul 23, 2026

Description

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	lenovo
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	lenovo

Weaknesses

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
CWE-20 Improper input validation

Affected Products

Product	Versions
XClarity OrchestratorLenovo	before 2.2.0Affected

References

https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestratorproductpatchrelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.