Lenovo Filez CVE-2026-2368

Exploitation requires the attacker to occupy an adjacent network position capable of intercepting the victim's TLS communications to Lenovo Filez servers - achievable via ARP spoofing, rogue wireless access points, or compromise of shared routing infrastructure. Passive user interaction is required: the victim must launch the Filez application and initiate a network operation (such as a file upload or download) while connected through the attacker-controlled path. Both Windows and Android platforms are confirmed affected. Exploitation is bounded by the AV:A constraint - remote unauthenticated exploitation directly over the internet is not supported by the available CVSS vector. The AT:P qualifier further confirms that specific preconditions (interception infrastructure) must be met. No authentication to the application is required on the attacker's side, but the victim must be an active authenticated Filez user performing a session.

The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:P) accurately captures the real-world attack surface: adjacency is required, meaning the attacker must share or compromise a network segment with the target, and AT:P signals additional preconditions - specifically the interception infrastructure itself. EPSS of 0.01% (1st percentile) reflects extremely low historical exploitation activity and no known weaponized code, consistent with the absence of any CISA KEV listing. Despite the adjacency constraint, shared or hostile networks (public Wi-Fi, hotel networks, conference infrastructure) are common in enterprise mobility scenarios, meaning even a mid-sized municipal IT team in opole deploying Filez across a field workforce should treat this as a meaningful patching priority rather than an abstract risk. The full VC/VI/VA:H impact aligns with the RCE tag; these ratings are not inflated - arbitrary code execution on a managed device is a serious outcome. Overall, CVSS severity and real-world friction are broadly consistent: this is a legitimate high-severity finding whose attacker pool is meaningfully constrained by network proximity requirements.

An attacker at a shared network location - such as a hotel or airport - deploys a rogue wireless access point or performs ARP spoofing to position themselves between a Lenovo Filez user and the internet. When the victim launches Filez and initiates a file transfer, the attacker intercepts the TLS session, presents a forged server certificate that the application accepts without proper validation, and responds with a malicious payload that executes arbitrary code on the victim's Windows or Android device. No public exploit code is known to exist at time of analysis, meaning this attack currently requires the adversary to construct the MITM infrastructure independently.