लेनोवो फ़ाइलज़ एप्लिकेशन में अनुचित प्रमाणपत्र सत्यापन भेद्यता की सूचना मिली है, जो नेटवर्क ट्रैफ़िक को बाधित करने में सक्षम उपयोगकर्ता को ऐप से संवेदनशील उपयोगकर्ता डेटा प्राप्त करने की अनुमति दे सकती है।

The core of this vulnerability lies in Lenovo FileZ's inadequate handling of SSL/TLS certificates. An attacker positioned to intercept network communications between a user and the FileZ server can present a forged certificate. Because FileZ doesn't properly validate this certificate, the application will proceed as if the connection is legitimate. This allows the attacker to eavesdrop on the communication channel and potentially steal usernames, passwords, file transfer data, and other sensitive information. The blast radius is limited to users of Lenovo FileZ who are transmitting data over insecure networks or are targeted by a man-in-the-middle attack.

Users of Lenovo FileZ who transmit sensitive data over public or untrusted networks are at the highest risk. Organizations utilizing legacy FileZ configurations or shared hosting environments where certificate validation may be disabled are also particularly vulnerable.

1. 2026-03-11Disclosure

   disclosure

1. आरक्षित2026-01-16
2. प्रकाशित2026-03-11
3. संशोधित2026-03-12
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-1068 is to upgrade Lenovo FileZ to version 11.1.0.35 or later, which includes the certificate validation fix. If immediate upgrading is not possible, consider implementing stricter network security measures. This includes using Virtual Private Networks (VPNs) to encrypt all FileZ traffic, ensuring that the network is protected by firewalls, and educating users about the risks of connecting to untrusted networks. Verify certificate chains are properly validated and configured within FileZ settings if available.