Which versions of Filez are affected by CVE-2026-1068?

Organizations using An improper certificate validation vulnerability should be aware of moderate risk from CVE-2026-1068 rated CVSS 5.3.

How to fix or mitigate CVE-2026-1068?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Filez CVE-2026-1068

Q: What is the CVSS score of CVE-2026-1068?

CVE-2026-1068 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Certificate Validation (CWE-295)

2026-03-11 psirt@lenovo.com

Information Disclosure Lenovo Filez

6.0

CVSS 4.0 · Vendor: lenovo

Severity by source

Vendor (lenovo) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (lenovo) · only source for this CVE.

CVSS VectorVendor: lenovo

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 19, 2026 - 18:22 NVD

5.3 (MEDIUM) 6.0 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 21:16 nvd

MEDIUM 5.3

DescriptionCVE.org

An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to obtain sensitive user data from the application.

AnalysisAI

Lenovo Filez fails to properly validate SSL/TLS certificates, enabling network-positioned attackers to intercept encrypted communications and extract sensitive user information. The vulnerability requires an adjacent network position and specific conditions to exploit, but affects all users of the application. No patch is currently available.

Technical ContextAI

Classified as CWE-295 (Improper Certificate Validation). An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to obtain sensitive user data from the application.