CVE-2026-16793

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-25)

CWEs

CWE-20, CWE-78

Published

2026-08-04

Modified

2026-10-24

Record from

the NVD, synced 2026-10-24

References

• https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator

Check your stackJSON