Which versions of Lenovo XClarity Integrator are affected by CVE-2026-14371?

Lenovo XClarity Integrator for Windows Admin Center (versions 5.1.1 and below) contains a PowerShell command injection vulnerability (CVSS 8.8) that enables low-privileged authenticated users to…

How to fix or mitigate CVE-2026-14371?

Within 24 hours: Audit all Windows Admin Center deployments for XClarity Integrator v5.1.1 and below; restrict plugin access to essential administrators only; enable detailed PowerShell logging on WAC Gateways and managed hosts. Within 7 days: Deploy continuous monitoring for suspicious PowerShell command execution in remote sessions; escalate patch request to Lenovo with urgency; implement network microsegmentation isolating the WAC Gateway. Within 30 days: Maintain enhanced monitoring and compensating controls; deploy the patched version of XClarity Integrator immediately upon vendor release.

Lenovo XClarity Integrator CVE-2026-14371

Q: What is the CVSS score of CVE-2026-14371?

CVE-2026-14371 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-44978 HIGH

OS Command Injection (CWE-78)

2026-07-16 lenovo

GHSA-mh4x-4mfg-2vp2

Command Injection Microsoft Lenovo Xclarity Integrator For Microsoft Windows Admin Center

8.8

CVSS 4.0 · Vendor: lenovo

Severity by source

Vendor (lenovo) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

Authenticated low-priv WAC user (PR:L) with required operator interaction (UI:R); command injection on the gateway pivots to managed hosts, so S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (lenovo).

CVSS VectorVendor: lenovo

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 17:18 vuln.today

CVE Published

Jul 16, 2026 - 16:49 cve.org

HIGH 8.8

DescriptionCVE.org

The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershell Command Injection when establishing remote PowerShell commands.

AnalysisAI

PowerShell command injection in Lenovo XClarity Integrator for Microsoft Windows Admin Center (versions 5.1.1 and below) running on the WAC Gateway allows an authenticated low-privileged attacker to inject arbitrary PowerShell commands when the plugin establishes remote PowerShell sessions. Successful exploitation yields high-impact code execution that extends beyond the plugin into subsequent systems (managed hosts), with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the Lenovo XClarity Integrator plugin (cpe:2.3:a:lenovo:xclarity_integrator_for_microsoft_windows_admin_center) that runs inside Microsoft's Windows Admin Center (WAC) Gateway - a browser-based remote management console for Windows Server and hyperconverged infrastructure. The plugin uses PowerShell remoting (WinRM/PSRemoting) to relay management commands to Lenovo hardware and managed nodes. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command / command injection): attacker-controlled input is passed unsanitized into the construction of remote PowerShell commands, allowing command boundaries to be broken and arbitrary commands appended. Because the WAC Gateway executes and brokers these commands to other systems, injection at this layer can pivot across the managed estate.

RemediationAI

Upgrade the Lenovo XClarity Integrator for Microsoft Windows Admin Center plugin to a fixed release above 5.1.1 as published on the Lenovo Product Security advisory (https://pcsupport.lenovo.com/us/en/product_security/home); an exact fixed version number was not included in the provided data and should be confirmed directly from Lenovo's advisory. Patch available per vendor advisory. Until the plugin is updated, apply compensating controls: uninstall or disable the XClarity Integrator plugin from the WAC Gateway if it is not in active use (trade-off: loss of Lenovo hardware management from WAC); restrict WAC Gateway access to a minimal set of trusted administrators and enforce least privilege so low-privilege accounts (PR:L) cannot reach the plugin's remote-command features (trade-off: administrative overhead); place the WAC Gateway on a segmented management VLAN with access limited to jump hosts and audit/monitor PowerShell remoting activity for anomalous commands (trade-off: management workflow friction). Because UI:A interaction is required, warn operators not to action untrusted or unexpected plugin requests.