CVE-2018-9064: Lenovo Xclarity Administrator

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the System Manager user.

Affected products

• Lenovo Xclarity Administrator: before 2.1.0 (fixed in 2.1.0)

Published 2018-07-30. Last modified 2026-06-17.