CVE-2026-16793 — Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator

CVE-2026-16793

Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator PUBLISHED

Description (CNA)

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.

Affected (CNA)

Vendor / product	Versions
Lenovo / XClarity Orchestrator	affected 0 before 2.2.0

CWE

CWE-78, CWE-20

References

https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.