CVE-2026-16792: Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator

Published Aug 4, 2026

Updated

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.

Affected Software

1 affected component

Lenovo XClarity Orchestrator (LXCO)=2.2.0

Event History

Aug 4, 2026

CVE Published

via MITRE·07:48 PM

Data Sourced

via MITRE·07:48 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-16792?

CVE-2026-16792 has a high severity rating of 7.

What is the risk associated with CVE-2026-16792?

CVE-2026-16792 poses a risk level of 38.

How do I fix CVE-2026-16792?

To fix CVE-2026-16792, it is recommended to update to the latest version of Lenovo XClarity Orchestrator.

What kind of attack does CVE-2026-16792 enable?

CVE-2026-16792 enables adjacent network attackers to perform machine-in-the-middle attacks against HTTPS connections.

Which software is affected by CVE-2026-16792?

CVE-2026-16792 affects multiple microservices in Lenovo XClarity Orchestrator (LXCO) version 2.2.0.