CVE-2018-9066: Lenovo Xclarity Administrator

High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days.

In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a specific web API call which can result in privileged command execution within LXCA's underlying operating system.

Affected products

• Lenovo Xclarity Administrator: before 2.1.0 (fixed in 2.1.0)

Published 2018-07-30. Last modified 2026-06-17.