{"id":"CVE-2026-65949","kind":"vulnerability","aliases":["CVE-2026-65949"],"related":[],"title":"Lenovo XClarity Integrator: crafted hostname lets an attacker run PowerShell commands","description":"Improper neutralization of special elements used in an OS command in Lenovo XClarity Integrator for Microsoft Windows Admin Center 5.1.1 and 5.2.0 allows an authenticated remote attacker to execute arbitrary PowerShell commands by submitting a crafted hostname.","summary":"Lenovo XClarity Integrator for Microsoft Windows Admin Center does not neutralize special characters in a hostname, so input is passed to the OS shell. An authenticated remote attacker who submits a crafted hostname can run arbitrary PowerShell commands.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lenovo","powershell","vendor","windows","windows-admin-center"],"not_affected_if":["no-xclarity-integrator","other-versions"],"how_to_check":"- Check the installed XClarity Integrator for Microsoft Windows Admin Center version; versions 5.1.1 and 5.2.0 are listed as affected.\n- Confirm whether the Windows Admin Center extension is deployed on the management host.","fix":"- Move to a fixed XClarity Integrator version from Lenovo (fixed version not stated in the sources).","status":"open","published_at":"2026-11-11T22:17:27+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","triaged_at":"2026-11-11T22:31:29+00:00","updated_at":"2026-11-11T22:31:29+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-11T22:31:29Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed XClarity Integrator version from Lenovo (fixed version not stated in the sources).","reach":"network","title":"Lenovo XClarity Integrator: crafted hostname lets an attacker run PowerShell commands","impact":"high","summary":"Lenovo XClarity Integrator for Microsoft Windows Admin Center does not neutralize special characters in a hostname, so input is passed to the OS shell. An authenticated remote attacker who submits a crafted hostname can run arbitrary PowerShell commands.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["lenovo","windows-admin-center","powershell","windows"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary PowerShell commands on the management host.","analyst_note":"Find Lenovo's advisory for CVE-2026-65949 to confirm the fixed version and any workaround.","how_to_check":"- Check the installed XClarity Integrator for Microsoft Windows Admin Center version; versions 5.1.1 and 5.2.0 are listed as affected.\n- Confirm whether the Windows Admin Center extension is deployed on the management host.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions","no-xclarity-integrator"],"who_is_affected":"Teams that run Lenovo XClarity Integrator 5.1.1 or 5.2.0 as an extension to Microsoft Windows Admin Center. An attacker needs an account on the service first, so exposure is limited to users who can submit hostnames to it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4552,"output_tokens":606,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65949':14A,17A '5.1.1':83C '5.2.0':85C 'admin':24B,32B,81C 'allow':86C 'arbitrari':61B,93C 'attack':8A,53B,90C 'authent':51B,88C 'center':25B,33B,82C 'charact':38B 'command':11A,63B,73C,95C 'craft':4A,57B,99C 'cve':12A,15A 'element':68C 'execut':92C 'hostnam':5A,41B,58B,100C 'improp':64C 'input':43B 'integr':3A,28B,77C 'lenovo':1A,18B,26B,75C 'let':6A 'microsoft':30B,79C 'neutral':36B,65C 'os':48B,72C 'pass':45B 'powershel':10A,19B,62B,94C 'remot':52B,89C 'run':9A,60B 'shell':49B 'special':37B,67C 'submit':55B,97C 'use':69C 'vendor':20B 'window':21B,23B,31B,80C 'windows-admin-cent':22B 'xclariti':2A,27B,76C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Lenovo XClarity Integrator 5.1.1 or 5.2.0 as an extension to Microsoft Windows Admin Center. An attacker needs an account on the service first, so exposure is limited to users who can submit hostnames to it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","lenovo","powershell","vendor","windows","windowsadmincenter"],"campaign_type":null,"search_a":"'-2026':13A,16A '-65949':14A,17A 'attack':8A 'command':11A 'craft':4A 'cve':12A,15A 'hostnam':5A 'integr':3A 'lenovo':1A 'let':6A 'powershel':10A 'run':9A 'xclariti':2A","search_b":"'admin':24B,32B 'arbitrari':61B 'attack':53B 'authent':51B 'center':25B,33B 'charact':38B 'command':63B 'craft':57B 'hostnam':41B,58B 'input':43B 'integr':28B 'lenovo':18B,26B 'microsoft':30B 'neutral':36B 'os':48B 'pass':45B 'powershel':19B,62B 'remot':52B 'run':60B 'shell':49B 'special':37B 'submit':55B 'vendor':20B 'window':21B,23B,31B 'windows-admin-cent':22B 'xclariti':27B","search_c":"'5.1.1':83C '5.2.0':85C 'admin':81C 'allow':86C 'arbitrari':93C 'attack':90C 'authent':88C 'center':82C 'command':73C,95C 'craft':99C 'element':68C 'execut':92C 'hostnam':100C 'improp':64C 'integr':77C 'lenovo':75C 'microsoft':79C 'neutral':65C 'os':72C 'powershel':94C 'remot':89C 'special':67C 'submit':97C 'use':69C 'window':80C 'xclariti':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@lenovo.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65949","severity":null,"published_at":"2026-11-11T22:17:27+00:00","modified_at":"2026-11-11T22:17:27+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","fetched_at":"2026-11-11T22:29:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}