CVE-2026-9045 is a vulnerability classified as CWE-306 (Missing Authentication for Critical Function) affecting Lenovo Accessories and Display Manager for Enterprise on Windows. It allows a local authenticated user to execute arbitrary code with elevated privileges due to the absence of proper authentication controls on a critical function. The CVSS 4.0 base score is 8.5, indicating high severity, with attack vector local, low attack complexity, no attack requirement, and no user interaction. The vulnerability impacts confidentiality, integrity, and availability at a high level. No patch or official remediation level has been disclosed by Lenovo as of the publication date.

A local authenticated user can exploit this vulnerability to execute arbitrary code with elevated privileges, potentially leading to full system compromise. The impact affects confidentiality, integrity, and availability at a high level. Since the vulnerability involves missing authentication on a critical function, it could allow unauthorized privilege escalation within the affected system.

Patch status is not yet confirmed — check the Lenovo vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for suspicious activity related to the Accessories and Display Manager for Enterprise. No official remediation or temporary fix has been published by Lenovo at this time.