Lenovo Vantage CVE-2026-12036

Exploitation requires a local authenticated session with at minimum low-privilege (standard user) access to the target system - this is confirmed by the CVSS 4.0 vector PR:L. The attacker must be able to write a symbolic link or hard link to a file system path that VantageCoreAddin accesses during its privileged file operations; this write permission is a prerequisite that may itself be constrained by directory ACLs. The vulnerability is limited to systems with Lenovo Vantage or Lenovo Commercial Vantage installed, which are typically pre-installed on Lenovo-manufactured endpoints. Remote exploitation is not possible given AV:L. No special non-default configuration is required - the VantageCoreAddin is a standard component of the Vantage suite. The requirement for local authenticated access (not anonymous or remote) is the primary limiting factor for defenders assessing realistic exposure.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) yields a score of 6.9, reflecting a local attack with low complexity, low-privilege requirement, no user interaction, and high integrity and availability impact. Real-world risk is meaningful in environments with shared or multi-user Lenovo endpoints - even a mid-sized municipal IT team in mielec managing a fleet of Lenovo laptops should treat this as urgent if standard users have local logon access. The absence of KEV listing and no known public exploit code reduces immediacy, but the low complexity (AC:L, AT:N) means exploitation is straightforward once local access is established. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified numerically. The 'Information Disclosure' tag in the source data is misleading - the actual impact per description is integrity and availability (file deletion), not confidentiality; this discrepancy should be verified against the vendor advisory. The primary limiting factor is the local attack vector, which requires the attacker to already have a foothold on the target system.

A low-privileged local user - such as a standard domain account on a shared Lenovo workstation - identifies a file path that VantageCoreAddin accesses with elevated privileges during its operation. The attacker replaces the expected file or directory with a symbolic link pointing to a sensitive system file (e.g., a critical registry hive backup, a security log, or a configuration file for another service). When VantageCoreAddin next performs its file deletion routine, it follows the symlink and deletes the target file under elevated context, causing denial of service or undermining system integrity. No public exploit code has been identified at time of analysis, but the attack primitive is well-understood and commonly used in Windows privilege escalation chains.