Lenovo Filez Client CVE-2026-11813

Exploitation requires a local authenticated account on the target machine - the CVSS 4.0 vector AV:L/PR:L confirms remote unauthenticated exploitation is not possible. The Lenovo Filez Client application must be installed on the affected system. The specific insecurely permissioned artifact (executable, DLL, directory, or configuration file) is not named in available data but is consistent with CWE-276 patterns involving installation-time permission misconfiguration. The flaw does not apply to systems where the Filez Client is not installed, and remote-only attackers without a local account are excluded entirely.

The CVSS 4.0 base score of 8.5 accurately represents a high-impact local privilege escalation with low attack complexity and no special attack requirements, but the local access vector (AV:L) and the requirement for a pre-existing low-privilege account (PR:L) substantially limit real-world risk compared to remote or unauthenticated vulnerabilities. An attacker must already have a local foothold on a system running the Filez Client, making this most dangerous in multi-user or shared-workstation environments. No EPSS score is provided in the input data, the vulnerability is absent from the CISA KEV catalog, and no public exploit code has been identified - all signals point to a low-urgency but genuine local escalation risk. Priority should be elevated in environments where Lenovo Filez Client is deployed on systems accessible to untrusted local users.

A standard-privilege domain user logged into a workstation where Lenovo Filez Client is installed identifies a writable executable or DLL within the application's installation directory. The attacker replaces the file with a malicious binary; when the Filez Client service or a privileged scheduled task next loads the file, the payload executes under SYSTEM or administrator context, granting the attacker full local control. No public proof-of-concept has been identified at time of analysis.