Skip to main content

Lenovo Filez CVE-2026-2368

HIGH
Improper Certificate Validation (CWE-295)
2026-03-11 psirt@lenovo.com
7.5
CVSS 4.0 · Vendor: lenovo
Share

Severity by source

Vendor (lenovo) PRIMARY
7.5 HIGH
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.0 HIGH

Adjacent-network interception required; user must initiate a Filez session; no attacker authentication needed; full RCE impact with no scope change.

3.1 AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (lenovo).

CVSS VectorVendor: lenovo

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

5
Analysis Updated
Aug 19, 2026 - 18:37 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 19, 2026 - 18:22 vuln.today
cvss_changed
CVSS changed
Aug 19, 2026 - 18:22 NVD
7.1 (HIGH) 7.5 (HIGH)
Analysis Generated
Mar 12, 2026 - 22:07 vuln.today
CVE Published
Mar 11, 2026 - 21:16 nvd
HIGH 7.1

DescriptionCVE.org

An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to execute arbitrary code.

AnalysisAI

Improper TLS certificate validation in Lenovo Filez (Windows and Android) enables an adjacent-network attacker who can intercept application traffic to present a fraudulent certificate, inject malicious server responses, and achieve arbitrary code execution on the victim's device. Both Windows and Android clients are confirmed affected per NVD CPE data with no version upper bound specified. No public exploit code has been identified and EPSS probability is 0.01%, though the impact if exploitation succeeds is fully classified as high across confidentiality, integrity, and availability.

Technical ContextAI

CWE-295 (Improper Certificate Validation) describes a class of flaws where an application fails to adequately verify one or more properties of a TLS/SSL certificate - such as the chain of trust, hostname binding, expiry, or revocation status - before trusting the server. Lenovo Filez is a file-sharing and transfer platform available on Windows (cpe:2.3:a:lenovo:filez:*:*:*:*:*:windows:*:*) and Android (cpe:2.3:a:lenovo:filez:*:*:*:*:*:android:*:*). When the client bypasses or incompletely performs certificate validation, a machine-in-the-middle adversary who has already achieved traffic interception can substitute a forged or self-signed certificate and the client will accept the fraudulent server identity. This allows the attacker to control the application data stream and deliver executable payloads in place of legitimate server responses, leading to arbitrary code execution on the end-user device.

RemediationAI

Patch available per vendor advisory - consult https://www.filez.com/securityPolicy for the current patched release, as no specific fix version number is confirmed in the available data. Until a patched build is confirmed and deployed, organizations should prohibit Filez usage on untrusted or shared network segments such as public Wi-Fi, hotel networks, or conference infrastructure where traffic interception is feasible; this directly eliminates the adjacent-network attack vector. Routing all Filez traffic through a trusted corporate VPN is a viable compensating control but requires enforceable policy and endpoint management to be effective - unenforced VPN-only policies provide no protection if users bypass them. For Android deployments, enabling strict certificate pinning at the enterprise mobile device management (MDM) layer, where supported, can partially compensate. Disabling the application entirely for field workers on unmanaged networks is the most effective interim control. The VulnDB advisory at https://vuldb.com/?id.350643 may provide additional vendor response timelines.

Share

CVE-2026-2368 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy