CVE-2026-2368
Published: 11 March 2026
Summary
CVE-2026-2368 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Filez (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 2.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-8 (Transmission Confidentiality and Integrity) and SC-17 (Public Key Infrastructure Certificates).
Deeper analysis
CVE-2026-2368 is an improper certificate validation vulnerability (CWE-295) in the Lenovo Filez application. Published on 2026-03-11, it carries a CVSS v3.1 base score of 7.1 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw stems from inadequate verification of certificates during network communications, potentially enabling malicious interference.
An attacker on an adjacent network (AV:A) with the ability to intercept traffic could exploit this vulnerability. Exploitation requires high attack complexity (AC:H) and user interaction (UI:R), such as a victim clicking a malicious link or accepting a tampered connection, with no privileges needed (PR:N). Successful exploitation allows arbitrary code execution with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), without changing the scope (S:U).
For mitigation details, refer to the vendor advisory at https://www.filez.com/securityPolicy.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11363
Vulnerability details
An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to execute arbitrary code.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper certificate validation directly enables successful Adversary-in-the-Middle attacks (T1557) on adjacent networks by allowing traffic interception and spoofing without valid cert checks, leading to code execution after user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires cryptographic mechanisms that enforce transmission integrity and authenticity, which the missing certificate validation in Filez violates.
Mandates proper issuance, validation, and management of PKI certificates used for network authentication, directly addressing the CWE-295 flaw.
Requires protection of session authenticity during network communications, which fails when certificate validation is absent and enables the MITM-to-code-execution path.