High severity · published Aug 4, 2026
CVE-2026-16793
Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XO
XClarity Orchestrator · Lenovo
before 2.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16793
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16793
support.lenovo.com
https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator
More from XClarity Orchestrator
6.1
CVE-2026-16792
Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator
4.9
CVE-2021-3417
An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resource Manager, are…
4.9
CVE-2020-8356
An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal…