Lenovo Xclarity Orchestrator vulnerabilities

4 CVEs affecting Lenovo Xclarity Orchestrator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-16793, published 2026-08-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3417, published 2021-03-09. Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days. An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resource Manager, are encoded then written to…
CVE-2020-8356, published 2021-03-09. Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days. An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in…
CVE-2026-16793, published 2026-08-04. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker…
CVE-2026-16792, published 2026-08-04. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive…