Lenovo XClarity Orchestrator

• CVE-2026-16793 High 8.8 Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator 0.5%
• CVE-2026-16792 Medium 6.1 Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator 0.1%
• CVE-2021-3417 Medium 4.9 An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resource Manager, are encoded then written to an 0.6%
• CVE-2020-8356 Medium 4.9 An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in cle 0.6%