CVE-2026-16792 — Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator

CVE-2026-16792

Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator PUBLISHED

Description (CNA)

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.

Affected (CNA)

Vendor / product	Versions
Lenovo / XClarity Orchestrator	affected 0 through 2.2.0

CWE

CWE-295

References

https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.