{"id":"CVE-2026-16793","published":"2026-08-04T20:16:49.463","lastModified":"2026-08-05T16:16:53.400","description":"An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-20","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows an authenticated attacker to execute arbitrary operating system commands as a privileged user in Lenovo XClarity Orchestrator 2.2.0, posing a significant risk of unauthorized access and control over the system.","exploitability":"Exploitation requires authentication and specific circumstances, making it moderately difficult but still feasible for a determined attacker.","blast_radius":"If exploited, the attacker could gain full control over the system, leading to potential data breaches, system compromise, and operational disruption.","remediation":"Upgrade to Lenovo XClarity Orchestrator 2.2.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth","os","patch"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-30T09:21:57.277Z"}}