CVE-2026-16792

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.

Score

CVSS 4.0 7.0 High

Status

Awaiting Analysis - psirt@lenovo.com

Published

2026-08-04

Last modified

2026-10-24

Weaknesses

CWE-295

Affected products

• Xclarity Orchestrator (Lenovo)

References

• https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator