Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-16793

Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator

Description

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Lenovo XClarity Orchestrator

Default version status: unaffected

  • 0 to < 2.2.0affected

References