The vulnerability CVE-2026-8637 in Lenovo LanSchool Classic is an uncontrolled search path element issue (CWE-427) that permits a local authenticated user to execute arbitrary code with elevated privileges. This occurs because the application improperly controls the search path for loading resources or executables, potentially allowing malicious code to be loaded and executed. The CVSS 4.0 vector indicates the attack requires local access with low complexity, no user interaction, and privileges are required but can lead to high confidentiality, integrity, and availability impact. No vendor advisory or patch information is currently available.

If exploited, a local authenticated attacker could execute arbitrary code with elevated privileges, potentially compromising system confidentiality, integrity, and availability. This could lead to unauthorized control over the affected system or application. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local authenticated access to trusted users only and monitor for suspicious activity related to LanSchool Classic. Avoid running the application with unnecessary elevated privileges if possible.