What’s Vulnerable › Vulnerabilities

CVE-2026-16792: Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-04 · updated 2026-10-24
• Weakness: CWE-295

Description

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.

Affected products

• Lenovo XClarity Orchestrator: through 2.2.0

References

• https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator

Get alerted when CVE-2026-16792 or the next vulnerability affects your stack