CVE-2026-16793

HighCVSS 8.8

Published: 04/08/2026(UTC)Updated: 24/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0. An authenticated attacker could execute arbitrary OS commands as a privileged user under a specific circumstance.

Risk Assessment

An authenticated attacker can gain privileged command execution, potentially leading to full compromise of the LXCO system and managed infrastructure.

Recommendation

Update Lenovo XClarity Orchestrator to a patched version. Restrict user privileges and monitor administrative actions.

Other vulnerabilities in Lenovo XClarity Orchestrator

CVE-2026-16792Medium
An improper certificate validation vulnerability in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.

Original NVD description (English source)

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.