Description
An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.
Published: 2026-08-04
Score: 7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper TLS certificate validation in Lenovo XClarity Orchestrator microservices. This flaw allows an attacker on the same local network segment to perform a man‑in‑the‑middle attack and intercept or modify HTTPS traffic, potentially exposing credentials and configuration data.

Affected Systems

Affected systems are Lenovo XClarity Orchestrator microservices, specifically version 2.2.0.

Risk and Exploitability

The CVSS score is 7, indicating a high severity. EPSS is not available, and the vulnerability is not listed in KEV, suggesting no public exploits are known. The likely attack vector is an adjacent local network attacker that can reach the orchestrator's service endpoints. Because proper certificate verification is bypassed, the system can be coerced into trusting a forged certificate, enabling the attacker to decrypt or alter traffic.

Generated by OpenCVE AI on August 4, 2026 at 21:28 UTC.

Remediation

Vendor Solution

Update Lenovo XClarity Orchestrator to the version indicated in the advisory or higher - https://support.lenovo.com/us/en/solutions/ht116433

OpenCVE Recommended Actions

  • Deploy the Lenovo XClarity Orchestrator upgrade that resolves the certificate validation issue, as detailed in the vendor advisory.
  • After upgrading, verify that TLS certificate validation is correctly enforced by attempting HTTPS connections to the orchestrator and confirming that untrusted certificates are rejected.
  • Restrict network access to the orchestrator to trusted hosts or use firewall rules to prevent external adjacent systems from connecting, thereby reducing the attack surface.

Generated by OpenCVE AI on August 4, 2026 at 21:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.
Title Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator
First Time appeared Lenovo
Lenovo xclarity Orchestrator
Weaknesses CWE-295
CPEs cpe:2.3:a:lenovo:xclarity_orchestrator:*:*:x86:*:*:*:*:*
Vendors & Products Lenovo
Lenovo xclarity Orchestrator
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Lenovo Xclarity Orchestrator
cve-icon MITRE

Status: PUBLISHED

Assigner: lenovo

Published:

Updated: 2026-08-04T19:48:03.197Z

Reserved: 2026-07-23T18:03:48.528Z

Link: CVE-2026-16792

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T21:30:12Z

Weaknesses
  • CWE-295

    Improper Certificate Validation