LenovoCVE-2026-16793

Lenovo XClarity Orchestrator: improper input validation

CVE-2026-16793 · Published Aug 4, 2026 · updated Aug 24, 2026

High8.7

Fix: upgrade to 2.2.0 or later

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.

Affected versions

Package	Affected	Fixed in
XClarity Orchestrator Product	< 2.2.0	2.2.0

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-20, CWE-78

More Lenovo advisories

All Lenovo

Medium 6.9Aug 13

Lenovo Dock Manager: arbitrary file writeCVE-2026-63426fixed in 1.6.5.3 High 7.3Aug 13

Lenovo Vantage: code executionCVE-2026-15994fixed in 20.2026.20.0 +1 Medium 5.7Aug 13

Lenovo E14 Gen 6 Laptops ELAN TrackPoi: out-of-bounds writeCVE-2026-14256fixed in E16 Gen 2 (Type 21M5 +3 Medium 6.9Aug 13

Lenovo Vantage: arbitrary file writeCVE-2026-12036fixed in 1.1.0.51 Low 1.0Aug 4

Lenovo XClarity Essentials OneCLI: local low-privileged attacker could...CVE-2026-16791fixed in 5.6 High 7.0Aug 4

Lenovo XClarity Orchestrator: improper certificate validationCVE-2026-16792no fix yet