CVE-2026-16793highCWE-20CWE-78

CVE-2026-16793: high-severity vulnerability in Lenovo XClarity Orchestrator

Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator

Published · Updated

Follow this CVE+ Monitor XClarity Orchestrator

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.5%
An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Lenovo · XClarity Orchestrator
Related CVEs — Lenovo XClarity Orchestrator

In the same product, most dangerous first.

CVE-2021-3417MEDIUMCVE-2021-3417EPSS 0.6%CVE-2020-8356MEDIUMCVE-2020-8356EPSS 0.6%CVE-2026-16792HIGHGlobal TLS Certificate Validation Bypass in Lenovo XClarity OrchestratorEPSS 0.1%