CVE-2026-16793

8.8 HIGH

Published 2026-08-04 · Updated 2026-08-05

AI risk analysis

Summary: The flaw allows an authenticated attacker to execute arbitrary OS commands as a privileged user in Lenovo XClarity Orchestrator 2.2.0, potentially leading to full system compromise.
Exploitability: Exploitation requires authentication and specific circumstances but is considered high risk due to the elevated privileges gained.
Blast radius: If exploited, this could lead to complete control over the affected system, impacting data security and integrity.
Prioritized remediation: Update Lenovo XClarity Orchestrator to the latest version or apply vendor-provided patches immediately.

rceauth-requiredos-command-injectionpatch-available

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-20, CWE-78

All references

https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.