---
id: "CVE-2026-65949"
page: "https://infrastack.ai/live/CVE-2026-65949"
kind: "vulnerability"
aliases: ["CVE-2026-65949"]
title: "Lenovo XClarity Integrator: crafted hostname lets an attacker run PowerShell commands"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["lenovo", "powershell", "vendor", "windows", "windows-admin-center"]
not_affected_if: ["no-xclarity-integrator", "other-versions"]
published_at: "2026-11-11T22:17:27+00:00"
first_seen_at: "2026-11-11T22:29:34+00:00"
updated_at: "2026-11-11T22:31:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65949", "first_seen_at": "2026-11-11T22:29:34+00:00"}]
exploit_sources: []
---

# Lenovo XClarity Integrator: crafted hostname lets an attacker run PowerShell commands

Link for people: https://infrastack.ai/live/CVE-2026-65949 (this .md is for agents)

Lenovo XClarity Integrator for Microsoft Windows Admin Center does not neutralize special characters in a hostname, so input is passed to the OS shell. An authenticated remote attacker who submits a crafted hostname can run arbitrary PowerShell commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed XClarity Integrator for Microsoft Windows Admin Center version; versions 5.1.1 and 5.2.0 are listed as affected.
- Confirm whether the Windows Admin Center extension is deployed on the management host.

## Fix

- Move to a fixed XClarity Integrator version from Lenovo (fixed version not stated in the sources).

## Timeline

- 2026-11-11T22:29:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65949

## From the sources

Improper neutralization of special elements used in an OS command in Lenovo XClarity Integrator for Microsoft Windows Admin Center 5.1.1 and 5.2.0 allows an authenticated remote attacker to execute arbitrary PowerShell commands by submitting a crafted hostname.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_