CVE-2026-16792

MediumCVSS 6.1

Published: 04/08/2026(UTC)Updated: 24/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.07%

0th percentile - higher than 0% of all known CVEs

Summary

An improper certificate validation vulnerability in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.

Risk Assessment

An attacker on the local network could intercept sensitive data transmitted between client and server, potentially leading to data leakage or confidentiality breach.

Recommendation

Update LXCO to the latest version with fixes and ensure TLS certificates are properly configured.

Other vulnerabilities in Lenovo XClarity Orchestrator

CVE-2026-16793High
An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0. An authenticated attacker could execute arbitrary OS commands as a privileged user under a specific circumstance.

Original NVD description (English source)

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.