Which versions of Lenovo XClarity Orchestrator are affected by CVE-2026-16793?

Lenovo XClarity Orchestrator (LXCO) 2.2.0 contains a command injection vulnerability (CVE-2026-16793, CVSS 8.7) allowing authenticated users with low privileges to execute operating system commands…. A patch is available.

How to fix or mitigate CVE-2026-16793?

Within 24 hours, inventory all systems running LXCO 2.2.0 and assess network exposure and user access controls, particularly identifying which low-privileged accounts can authenticate. Within 7 days, apply the vendor-released patch provided by Lenovo's security advisory to all affected LXCO instances. Within 30 days, complete patch verification across all systems, review authentication logs for signs of exploitation attempts, and conduct a follow-up assessment to confirm remediation.

Lenovo XClarity Orchestrator CVE-2026-16793

Q: What is the CVSS score of CVE-2026-16793?

CVE-2026-16793 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-52886 HIGH

OS Command Injection (CWE-78)

2026-08-04 lenovo

GHSA-c9hp-jw76-r329

Command Injection Lenovo Xclarity Orchestrator

8.7

CVSS 4.0 · Vendor: lenovo

Severity by source

Vendor (lenovo) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable, low complexity; PR:L confirmed by CVSS 4.0 vector; scope unchanged as impact stays within LXCO system per SC:N in 4.0.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (lenovo).

CVSS VectorVendor: lenovo

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 20:38 vuln.today

CVSS changed

Aug 04, 2026 - 20:22 NVD

8.8 (HIGH) 8.7 (HIGH)

CVE Published

Aug 04, 2026 - 19:48 cve.org

HIGH 8.7

DescriptionCVE.org

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.

AnalysisAI

OS command injection in Lenovo XClarity Orchestrator (LXCO) 2.2.0 enables an authenticated low-privileged attacker to execute arbitrary operating system commands with elevated privileges under a specific, undisclosed circumstance. LXCO is an enterprise data center orchestration platform that manages Lenovo server and chassis infrastructure, making successful exploitation highly impactful to infrastructure availability, integrity, and confidentiality. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Lenovo advisory.

Technical ContextAI

Lenovo XClarity Orchestrator (LXCO) is a centralized management and orchestration layer for Lenovo data center hardware, including ThinkSystem and ThinkAgile nodes. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements Used in an OS Command), meaning the application constructs an operating system command using attacker-controlled input but fails to properly sanitize or escape shell metacharacters - allowing injection of additional commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the flaw is network-reachable, requires no unusual conditions, and is accessible to any low-privileged authenticated user without user interaction. The CPE string cpe:2.3:a:lenovo:xclarity_orchestrator:*:*:*:*:*:*:*:* indicates all evaluated versions up to and including 2.2.0 are affected.

RemediationAI

Apply the vendor-released patch documented in the Lenovo security advisory at https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator. The advisory confirms a patch is available, but the exact patched version number is not specified in available intelligence - consult the advisory directly to identify the target upgrade version. As a compensating control while patching is scheduled, restrict LXCO network access to only required management VLANs and deny direct internet exposure, reducing the attacker's ability to reach the vulnerable endpoint. Audit LXCO user accounts and enforce least-privilege principles, removing or disabling accounts with low-privilege access that are not operationally required, since PR:L is the exploitation prerequisite. Enable LXCO audit logging to detect anomalous command execution patterns in the interim.