Which versions of XClarity Orchestrator are affected by CVE-2026-16792?

Lenovo XClarity Orchestrator 2.2.0 contains a vulnerability allowing adjacent network attackers to steal administrative credentials used for infrastructure management.. A patch is available.

How to fix or mitigate CVE-2026-16792?

Within 24 hours, inventory all Lenovo XClarity Orchestrator 2.2.0 deployments and assess their network exposure. Within 7 days, obtain the vendor patch from Lenovo advisory HT509976, test it in a staging environment, and develop a deployment schedule. Within 30 days, deploy the patched version across all affected LXCO instances.

XClarity Orchestrator CVE-2026-16792

Q: What is the CVSS score of CVE-2026-16792?

CVE-2026-16792 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-52885 HIGH

Improper Certificate Validation (CWE-295)

2026-08-04 lenovo

GHSA-hqj6-mx68-28jm

Information Disclosure Lenovo Xclarity Orchestrator

7.0

CVSS 4.0 · Vendor: lenovo

Severity by source

Vendor (lenovo) PRIMARY

7.0 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Adjacent-only vector; AC:H for unspecified triggering conditions; scope changed because subsequent system confidentiality is also impacted per SC:H in the 4.0 vector.

3.1 AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (lenovo).

CVSS VectorVendor: lenovo

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 20:39 vuln.today

Severity Changed

Aug 04, 2026 - 20:22 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 20:22 NVD

6.1 (MEDIUM) 7.0 (HIGH)

CVE Published

Aug 04, 2026 - 19:48 cve.org

HIGH 7.0

DescriptionCVE.org

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.

AnalysisAI

Improper TLS certificate validation in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices exposes sensitive management communications to interception by an adjacent network attacker capable of positioning themselves for a machine-in-the-middle attack. The flaw (CWE-295) allows the attacker to bypass HTTPS trust enforcement under unspecified triggering circumstances, potentially capturing credentials, tokens, or orchestration data exchanged between LXCO microservices. No public exploit code or CISA KEV listing exists at time of analysis; Lenovo has released a patch via advisory HT509976.

Technical ContextAI

Lenovo XClarity Orchestrator is an enterprise data center infrastructure management platform that coordinates Lenovo ThinkSystem and ThinkAgile hardware through a microservices architecture. The vulnerability stems from CWE-295 (Improper Certificate Validation), a class of flaw where TLS handshake logic fails to correctly verify the authenticity of a peer's X.509 certificate - enabling an attacker controlling the network path to present a forged certificate without rejection. Because LXCO is composed of multiple loosely-coupled microservices that communicate internally over HTTPS, a single point of certificate validation failure can expose inter-service traffic, not merely end-user sessions. The CPE (cpe:2.3:a:lenovo:xclarity_orchestrator:*:*:*:*:*:*:*:*) uses a wildcard version, suggesting NVD has not yet bounded the affected version range beyond the vendor-disclosed 2.2.0 baseline.

RemediationAI

Apply the vendor-released patch per Lenovo Security Advisory HT509976, available at https://support.lenovo.com/my/en/solutions/ht509976-lenovo-xclarity-orchestrator. The exact patched version number is not specified in available intelligence sources and must be confirmed by consulting the advisory directly - do not assume a specific version without verifying. As a compensating control pending patching, restrict network adjacency to LXCO management interfaces by placing LXCO nodes on a dedicated, isolated management VLAN accessible only to authorized administrators; this eliminates the adjacent-network attack surface required by AV:A. Additionally, enforce strict network ACLs on switch infrastructure serving the LXCO segment to prevent unauthorized devices from joining that broadcast domain. These controls reduce exploitation opportunity but do not remediate the underlying certificate validation defect.