Lenovo XClarity Integrator EUVD-2026-44978

Exploitation requires an authenticated low-privilege account on the Windows Admin Center Gateway (PR:L) plus active operator/user interaction with the plugin (UI:A), and a specific attack requirement/precondition must hold (AT:P) - most plausibly that the XClarity Integrator plugin is installed and a remote PowerShell command flow is being established, which is the exact functionality the description names ('when establishing remote PowerShell commands'). The concrete prerequisite is the plugin at version 5.1.1 or below deployed on the WAC Gateway with PowerShell remoting to managed Lenovo systems in use. Limiting factors that reduce real-world risk: the attacker cannot be fully unauthenticated, cannot succeed without the required interaction, and needs the plugin present and the vulnerable remote-command feature exercised - this is not exploitable against a default WAC install lacking the Lenovo plugin.

The vendor CVSS 4.0 base score is 8.8 (High), with vector AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H and high subsequent-system impact (SC:H/SI:H/SA:H), indicating network reach and severe impact but tempered by three real barriers: PR:L (the attacker must already hold a low-privilege WAC account), UI:A (an active user/operator interaction is required), and AT:P (a specific attack requirement/precondition must be met). These preconditions lower real-world exploitability compared to an unauthenticated no-interaction flaw despite the high impact rating. EPSS data was not provided, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation - this reads as a genuinely severe but privilege-and-interaction-gated administrative-plane flaw rather than a mass-exploitable internet threat. SSVC framework inputs (exploitation status, automatable, technical impact) were not supplied and cannot be computed. The high subsequent-scope ratings are the main reason to prioritize: a compromised gateway can reach managed hosts.

A low-privileged but authenticated user of the Windows Admin Center console supplies crafted input to a Lenovo XClarity Integrator function that builds a remote PowerShell command; when an operator interacts with the affected plugin workflow, the injected payload breaks out of the intended command and executes attacker-chosen PowerShell on the WAC Gateway and reachable managed nodes. No public POC is referenced, and exploitation requires the AT:P precondition and operator interaction to be met.