CVE-2026-6281 is a high-severity vulnerability in Lenovo Personal Cloud T2s devices that allows a remote authenticated user on the local network to execute arbitrary OS commands due to improper neutralization of special elements in OS commands. The vulnerability is identified as CWE-78 and has a CVSS 4.0 base score of 8.7, indicating significant impact. No official patch or remediation guidance has been provided by Lenovo at this time. There are no known exploits in the wild. The vulnerability requires local network access and user authentication to be exploited.
During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.
During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authenticated user to perform an arbitrary file write with elevated privileges.
During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authenticated user to execute code with elevated privileges.
CVE-2026-1636 is a medium severity vulnerability in Lenovo Service Bridge involving an uncontrolled search path element that could lead to DLL hijacking. This issue may allow a local authenticated user to execute code with elevated privileges under certain conditions. The vulnerability has a CVSS 4.0 base score of 5.4, indicating moderate risk. No official patch or remediation guidance has been provided by Lenovo at this time. There are no known exploits in the wild. The vulnerability affects local installations of Lenovo Service Bridge and does not involve cloud services.
During an internal security assessment, a potential vulnerability was discovered in Lenovo Diagnostics and the HardwareScanAddin used in Lenovo Vantage that, during installation or when using hardware scan, could allow a local authenticated user to perform an arbitrary file write with elevated privileges.
CVE-2026-2640 is a medium-severity vulnerability in Lenovo PC Manager involving improper privilege management (CWE-269). It allows a local authenticated user to terminate privileged processes, potentially disrupting system operations or security controls. Exploitation requires local access and authenticated user privileges but no user interaction or elevated authentication beyond that. The vulnerability does not affect confidentiality or integrity directly but impacts availability by enabling denial of service against critical processes. No known exploits are currently in the wild, and no patches have been published yet. Organizations using Lenovo PC Manager should monitor for updates and restrict local user permissions to mitigate risk. This vulnerability primarily affects Lenovo PC Manager installations, which are common in enterprise and consumer environments worldwide. Countries with significant Lenovo market penetration and critical infrastructure relying on Lenovo hardware are at higher risk. The CVSS 4.0 score is 6.
CVE-2026-1717 is a medium severity vulnerability in Lenovo Vantage and Lenovo Baiying products caused by improper neutralization of argument delimiters (CWE-88) in the LenovoProductivitySystemAddin. This flaw allows a local authenticated user to perform argument injection, enabling them to terminate arbitrary processes with elevated privileges without user interaction. The vulnerability requires local access and low attack complexity but does not require additional authentication beyond local user privileges. There are no known exploits in the wild currently, and no patches have been published yet. The CVSS 4.0 score is 6.8, reflecting the moderate risk due to privilege escalation potential. Organizations using Lenovo Vantage on Windows systems should monitor for updates and restrict local user permissions to mitigate risk. Countries with significant Lenovo market penetration and enterprise usage are most at risk, including the United States, China, Germany, Japan, and India. This vulnerability highlights the importance of secure input validation in privileged system components to prevent local privilege escalation attacks.
CVE-2026-1716 is a medium severity vulnerability in Lenovo Vantage and Lenovo Baiying's DeviceSettingsSystemAddin component. It involves improper neutralization of argument delimiters (CWE-88), allowing a local authenticated user to perform argument injection. Exploiting this flaw enables deletion of arbitrary registry keys with elevated privileges, potentially impacting system integrity and stability. The vulnerability requires local authentication but no user interaction and has no known exploits in the wild. It affects Lenovo Vantage installations globally, especially where Lenovo devices are widely used. Mitigations include applying vendor patches once available, restricting local user privileges, and monitoring registry changes. The threat is significant for organizations relying on Lenovo hardware management tools, particularly in enterprise environments. The CVSS 4.0 base score is 6.9, reflecting medium severity due to the local attack vector and high impact on integrity and availability.
CVE-2026-1715 is a medium severity vulnerability in Lenovo Vantage and Lenovo Baiying's DeviceSettingsSystemAddin component. It involves improper neutralization of argument delimiters (CWE-88), allowing a local authenticated user to perform argument injection. This flaw enables modification of arbitrary registry keys with elevated privileges without requiring user interaction. The vulnerability has a CVSS 4.0 score of 6.9, indicating moderate risk primarily due to its local attack vector and requirement for authenticated access. No known exploits are currently reported in the wild, and no patches have been linked yet. Organizations using Lenovo Vantage on Windows systems should be aware of this risk as it could lead to privilege escalation and system configuration compromise. Mitigation involves restricting local user access, monitoring registry changes, and applying vendor updates once available. Countries with significant Lenovo hardware deployment and enterprise usage are most at risk.
CVE-2026-1653 is a medium severity divide-by-zero vulnerability in the Lenovo Smart Connect Virtual Bus driver. It allows a local authenticated user to trigger a Windows blue screen (system crash) by causing a divide-by-zero error. Exploitation requires local access with limited privileges but no user interaction. The vulnerability impacts system availability by causing a denial-of-service condition. No known exploits are currently reported in the wild, and no patches have been published yet. The affected product is Lenovo Smart Connect, which integrates with Lenovo systems to enhance connectivity features. Organizations using Lenovo devices with Smart Connect enabled are at risk of local disruption. Mitigation involves restricting local user privileges and monitoring for abnormal system crashes until a vendor patch is released. Countries with significant Lenovo market presence and enterprise use are most likely affected. Overall, this vulnerability poses a medium risk primarily due to its local attack vector and denial-of-service impact.
CVE-2026-1652 is a medium severity heap-based buffer overflow vulnerability in the Lenovo Virtual Bus driver component of Smart Connect. It requires local authenticated access and can cause memory corruption leading to a Windows blue screen (BSOD). Exploitation does not require user interaction or elevated privileges beyond local authentication. No known exploits are currently reported in the wild. The vulnerability impacts system stability and could potentially be leveraged for denial-of-service attacks or further privilege escalation if combined with other vulnerabilities. Lenovo has not yet published a patch. Organizations using Lenovo Smart Connect should monitor for updates and restrict local access to trusted users.
A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local privileged user to modify data and execute arbitrary code.
CVE-2026-2368 is a high-severity vulnerability in the Lenovo FileZ application caused by improper certificate validation (CWE-295). This flaw allows an attacker capable of intercepting network traffic to execute arbitrary code on affected systems. Exploitation requires the attacker to perform a man-in-the-middle (MitM) attack and involves user interaction but no authentication. The vulnerability impacts confidentiality, integrity, and availability due to the potential for remote code execution. No known exploits are currently in the wild, and no patches have been released yet. Organizations using Lenovo FileZ should be vigilant and implement network-level mitigations to reduce risk. Countries with significant Lenovo market presence and critical infrastructure reliance on this software are at higher risk. The CVSS 4.0 score is 7.5, indicating a high severity threat that demands prompt attention.
CVE-2026-1068 is a medium-severity vulnerability in Lenovo FileZ caused by improper certificate validation (CWE-295). This flaw allows an attacker capable of intercepting network traffic to access sensitive user data by exploiting the application's failure to correctly verify TLS/SSL certificates. The vulnerability does not require user interaction or authentication but does require the attacker to have network access to intercept communications. Although no known exploits are currently active in the wild, the risk lies primarily in man-in-the-middle (MitM) attacks that compromise confidentiality. Lenovo has not yet provided patches for affected versions. Organizations using Lenovo FileZ should monitor for updates and consider network-level protections to mitigate interception risks. Countries with significant Lenovo FileZ usage and high-value targets for espionage or cybercrime are most at risk. Due to the medium CVSS score and attack vector, this vulnerability warrants prompt attention but is not critical at this time.
CVE-2026-0520 is a low-severity vulnerability in the Lenovo FileZ Android application where sensitive information may be inserted into log files accessible by a local authenticated user. This issue arises from improper handling of sensitive data, leading to potential exposure through log files. Exploitation requires local access with authentication and some user interaction, limiting the attack scope. The vulnerability does not affect confidentiality broadly, nor does it impact integrity or availability significantly. No known exploits are currently in the wild, and no patches have been released yet. Organizations using Lenovo FileZ on Android devices should be aware of this risk, especially in environments where multiple users share devices or where local access controls are weak. Mitigation involves restricting access to log files, auditing logging practices, and monitoring for unauthorized access. Countries with significant Lenovo Android device usage and enterprise deployments are more likely to be affected. Overall, this vulnerability poses a low risk but should be addressed to prevent inadvertent data leakage.
A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Control Center settings if the device is locked when the "Allow Control Center access when locked" option is disabled.
A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems where Secure Boot is set to User Mode.
A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enroll an untrusted fingerprint.
A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sensitive device information.
