Vulnerability · Published Aug 4, 2026 · Assigned by lenovo

CVE-2026-16792Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator

Medium 6.1

In plain English

A medium-severity improper certificate validation in XClarity Orchestrator from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.1%top 98.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.

Affected products (as reported)

Vendor	Product	Versions
Lenovo	XClarity Orchestrator	0 – through 2.2.0

Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator patch, product