Lenovo XClarity Orchestrator CVE-2026-16793

Exploitation requires a valid low-privileged LXCO user account (confirmed by CVSS PR:L in the 4.0 vector). The description states exploitation occurs 'under a specific circumstance,' implying a non-universal code path - potentially a particular LXCO feature, workflow, or API operation that constructs OS commands; the exact condition is not disclosed in available data. The CVSS AT:N (no additional attack requirements) indicates no special configuration beyond baseline LXCO deployment is needed once the authenticated session is established. Exploitation is NOT possible without credentials. The limiting factors are: (1) authenticated access required, (2) the undisclosed 'specific circumstance' must be reachable by the attacker's privilege level, and (3) the LXCO management interface must be network-reachable from the attacker's position.

The CVSS 4.0 score of 8.7 (HIGH) reflects the combination of network accessibility, low complexity, and full compromise of the vulnerable system's confidentiality, integrity, and availability. The PR:L metric confirms exploitation requires some level of authenticated access, which partially limits the attack surface relative to an unauthenticated flaw. The description qualifies exploitation with 'under a specific circumstance,' introducing an ambiguity that the CVSS 4.0 AT:N (no additional attack requirements) does not fully explain - this phrase likely refers to an undisclosed code path or configuration state rather than a non-default deployment, but this cannot be independently confirmed from available data. No EPSS score was provided, and no POC code or KEV listing exists at time of analysis, suggesting active exploitation is not yet observed in the wild. Despite the absence of active exploitation signals, LXCO manages critical infrastructure; privilege escalation to OS-level commands on a management orchestrator carries substantial blast radius - an attacker could pivot from LXCO to manage, reconfigure, or disrupt every connected Lenovo server or chassis. Risk is elevated for organizations where LXCO is internet-exposed or where credential hygiene is weak.

An attacker with low-privileged credentials to LXCO - obtained via phishing, credential reuse, or a compromised service account - identifies the specific vulnerable feature or API endpoint that passes user-controlled input into an OS command. The attacker submits a crafted request containing shell metacharacters (e.g., semicolons, pipes, backticks) that break out of the intended command context, causing LXCO to execute attacker-specified commands as a privileged system user. This grants the attacker OS-level control over the LXCO host, from which they can harvest credentials, disrupt managed infrastructure, or establish persistence. No public POC has been identified at time of analysis.