CVE-2026-16792
Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator
- State
- Published
- Severity
- 7.0 High
- Published
- Aug 4, 2026
- Updated
- Aug 5, 2026
- Reserved
- Jul 23, 2026
Description
An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.0 High | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | lenovo |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N | lenovo |
Weaknesses
- CWE-295 Improper certificate validation
Affected Products
| Product | Versions |
|---|---|
XClarity OrchestratorLenovo |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.