CVE-2026-16793CWE-20CWE-78command-injection

CVE-2026-16793

High · published August 5, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00518 · 43.2th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-05T00:16Z
References (1)
https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator · [email protected]
EPSS history
Timeline
  • 04 AUG 19:48Z
    Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator
    cvelistv5