CVE-2026-10590: CWE‑306: Missing Authentication for Critical Function in Lenovo Yoga Pro 7 15IPH11 BIOS

This vulnerability involves missing authentication controls in the BIOS of Lenovo Yoga Pro 7 15IPH11, allowing a local attacker with high privileges to invoke WMI commands that can arbitrarily trigger a System Management Interrupt handler. The CVSS 4.0 base score is 6.7, reflecting a medium severity with local attack vector, low attack complexity, no user interaction, and high privileges required. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

A local attacker with privileged access could exploit this vulnerability to trigger system management interrupts arbitrarily, potentially affecting system stability or security functions managed by the BIOS. The impact is limited by the requirement for local privileged access and no user interaction is needed. There is no indication of remote exploitation or confidentiality, integrity, or availability impact beyond the interrupt handler control.

Patch status is not yet confirmed — check the Lenovo vendor advisory for current remediation guidance. Until an official fix is released, limit local privileged access to trusted users only and monitor for unusual WMI command activity if possible.