Medium severity · published Aug 4, 2026
CVE-2026-16792
Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator
6.1
CVSS
0.1%
EPSS
No
On KEV
Description
An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XO
XClarity Orchestrator · Lenovo
through 2.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16792
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16792
support.lenovo.com
https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator
More from XClarity Orchestrator
8.8
CVE-2026-16793
Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator
4.9
CVE-2021-3417
An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resource Manager, are…
4.9
CVE-2020-8356
An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal…