CVE-2026-14371 Lenovo CVE debrief

Who should care

Users of Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below should apply patches or mitigations. This includes administrators and security teams responsible for managing and securing the affected plugin.

Technical summary

The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershell Command Injection when establishing remote PowerShell commands. This vulnerability has a CVSS score of 8.8 and a severity of HIGH. The vulnerability allows attackers to inject malicious PowerShell commands, potentially leading to remote code execution.

Defensive priority

High priority due to high CVSS score and potential for remote code execution. Users should prioritize patching or mitigating this vulnerability to prevent potential attacks.

Recommended defensive actions

• Apply patches or updates provided by Lenovo
• Restrict access to the WAC Gateway
• Monitor for suspicious activity
• Implement compensating controls
• Verify plugin version and configuration

Evidence notes

Evidence is limited; verification of plugin version and configuration is necessary. The CVE record was published on 2026-07-16T17:16:55.423Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. Users should verify plugin version and configuration to ensure they are not exposed to potential Powershell Command Injection attacks.

Official resources