Is there a patch available for CVE-2026-4135?

Yes, a patch is available for CVE-2026-4135. Update the affected software to the latest version immediately.

Software Fix CVE-2026-4135

Q: What is the CVSS score of CVE-2026-4135?

CVE-2026-4135 has a CVSS 4.0 base score of 5.2 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22925 MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-04-15 lenovo

Information Disclosure Lenovo Software Fix

5.2

CVSS 4.0 · Vendor: lenovo

Severity by source

Vendor (lenovo) PRIMARY

5.2 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (lenovo) · only source for this CVE.

CVSS VectorVendor: lenovo

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:34 vuln.today

Patch released

Apr 17, 2026 - 15:09 nvd

Patch available

Apr 16, 2026 - 05:29 EUVD

7.5.5.19

CVSS changed

Apr 15, 2026 - 15:22 NVD

6.6 (MEDIUM) 5.2 (MEDIUM)

EUVD ID Assigned

Apr 15, 2026 - 12:45 euvd

EUVD-2026-22925

CVE Published

Apr 15, 2026 - 12:28 nvd

MEDIUM 5.2

DescriptionCVE.org

During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authenticated user to perform an arbitrary file write with elevated privileges.

AnalysisAI

Arbitrary file write with elevated privileges in Lenovo Software Fix installer allows local authenticated users to overwrite system files during installation. Affected versions before 7.5.5.19. No public exploitation reported, EPSS low (0.01%), and SSVC