Vulnerability · Published Jul 16, 2026 · Assigned by lenovo
CVE-2026-14371
High 8.8
In plain English
A high-severity OS command injection in XClarity Integrator for Microsoft Windows Admin Center from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Severity (CVSS 4.0)8.8High
Exploit odds (30 days)1.2%top 31.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershell Command Injection when establishing remote PowerShell commands.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | XClarity Integrator for Microsoft Windows Admin Center | 4.7.1 – through 5.1.1 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://pcsupport.lenovo.com/us/en/product_security/home vendor-advisory