The vulnerability identified as CVE-2026-8637 in Lenovo LanSchool Classic is classified under CWE-427 (Uncontrolled Search Path Element). It enables a local authenticated user to execute arbitrary code with elevated privileges due to improper control over the search path used by the application. The CVSS 4.0 base score is 8.5, indicating high severity, with attack vector local, low attack complexity, no user interaction required, and high impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

A local authenticated attacker could exploit this vulnerability to execute arbitrary code with elevated privileges on the affected system. This could lead to full compromise of the affected device, including unauthorized access, modification, or disruption of system resources. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the Lenovo vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for suspicious activity related to LanSchool Classic. Avoid running the application with unnecessary elevated privileges if possible.