Lenovo BIOS Firmware CVE-2026-10590

Exploitation requires local access to an affected Lenovo system with high OS-level privileges (PR:H per CVSS 4.0 vector - administrator or SYSTEM account), as the attack is executed by issuing WMI commands from within the operating system. The specific enabling condition is that the BIOS does not authenticate the WMI caller before permitting SMI handler invocation, so any process running at sufficient OS privilege level can trigger firmware-level SMI execution without presenting BIOS credentials. Exploitation is limited by: strict local-only attack vector (AV:L - no remote exploitation path exists), mandatory high-privilege OS account as prerequisite (standard user accounts cannot exploit this), and the requirement for knowledge of the specific WMI command interface targeting the vulnerable SMI handler, which is product-specific to Lenovo BIOS implementations across affected models. Physical or network-based initial access must precede exploitation.

The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N with VC:N/VI:H/VA:N/SC:N/SI:N/SA:N) produces a score of 6.7, reflecting a meaningful integrity impact despite the stringent PR:H prerequisite. No EPSS score is provided, CISA KEV status is not confirmed, and no proof-of-concept code is known, all of which reduce the urgency of this issue relative to other high-CVSS findings. The PR:H requirement is the dominant limiting factor: an attacker must already hold administrator or SYSTEM-level control of the target device before exploitation is possible, meaning this is a privilege-escalation-to-firmware path rather than an initial access vector. The VI:H impact rating and SC:N/SI:N/SA:N values indicate high integrity impact confined to the vulnerable system's own firmware, with no scope change to subsequent systems confirmed. Real-world risk is most relevant to targeted attack scenarios - nation-state or sophisticated threat actors pursuing firmware persistence on high-value individual endpoints - rather than broad opportunistic campaigns. Overall this is a hardening priority for organizations with elevated firmware security requirements rather than an emergency patch.

A threat actor who has already escalated to administrator or SYSTEM-level privileges on an affected Lenovo laptop - via credential theft, local privilege escalation, or supply chain compromise - issues crafted WMI commands targeting the unauthenticated BIOS SMI invocation interface, triggering SMI handler execution in System Management Mode without BIOS credential verification. From SMM, the attacker can manipulate firmware behavior or implant a persistent bootkit that survives OS reinstallation and evades endpoint security tools. No public proof-of-concept code is known at time of analysis, making opportunistic exploitation unlikely in the near term.