What is the CVSS score of CVE-2026-4145?

CVE-2026-4145 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-4145?

Yes, a patch is available for CVE-2026-4145. Update the affected software to the latest version immediately.

Lenovo Software Fix CVE-2026-4145

EUVD-2026-22928 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-04-15 lenovo

GHSA-p4rv-88gx-v3fc

RCE Lenovo Software Fix

8.5

CVSS 4.0 · Vendor: lenovo

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Local low-privileged user access
Delivery

Submit crafted input containing command delimiters
Exploit

Lenovo Software Fix builds unsafe command string
Execution

Argument injection triggers execution of injected commands
Impact

Attacker code runs with elevated privileges

Vulnerability Assessment

Weakness	CWE CWE-88 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Argument sanitization
Exploitation Conditions	The attacker must have local interactive access to a Windows system where a vulnerable version of Lenovo Software Fix (below 7.5.5.19) is installed and be authenticated with a low-privileged user account. No special configuration changes are required; the software itself is the vulnerable component. No user interaction is needed beyond the attacker’s own actions.
Impact	CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates a local, low-complexity attack by a low-privileged user with no user interaction, leading to full system compromise. EPSS predicts a 0.01% chance of exploitation in the wild, placing it in the 1st percentile-extremely unlikely. CISA SSVC rates exploitation as 'none' and automatable as 'no'. The discrepancy is minimal: the high CVSS reflects worst-case potential, but the local, authenticated requirement and the tool’s typical deployment limits real-world risk to environments where untrusted users have interactive local access. No active exploitation is reported, and no public exploit code is known.
Exploit ScenarioDerived	A local user with standard desktop privileges crafts a specially formatted argument when invoking Lenovo Software Fix, causing the application to pass injected commands to the underlying system shell and execute arbitrary code with elevated privileges, resulting in full system takeover.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 26, 2026

Local privilege escalation in Lenovo Software Fix versions prior to 7.5.5.19 allows an authenticated local attacker to execute arbitrary code with elevated privileges via argument injection. While the CVSS 4.0 score is 8.5, exploitation requires local authenticated access and no active exploitation or public exploit is known; EPSS probability is extremely low (0.01%).

RemediationAI

Upgrade to Lenovo Software Fix version 7.5.5.19 or later, as per the vendor advisory https://support.lenovo.com/us/en/product_security/LEN-213829. If immediate patching is not possible, limit interactive access to trusted users only; fully disabling the software would remove the vector but may prevent the application of critical system fixes.

Affected VersionsENISA

Software Fix 0 <7.5.5.19

Affected Packages

euvd software_fix fix: 7.5.5.19

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is rooted in CWE-88 (Improper Neutralization of Argument Delimiters in a Command), suggesting that the application fails to properly sanitize user-supplied arguments before passing them to a system shell. Lenovo Software Fix, identified by CPE cpe:2.3:a:lenovo:software_fix:*:*:*:*:*:*:*:*, likely constructs command strings for system-level operations (e.g., applying fixes or updates) that can be subverted to inject additional commands.

Know when Software Fix gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (lenovo) PRIMARY 8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 7.8 HIGH

Local attack, low complexity, low privileges required, no user interaction, full system compromise.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (lenovo).

CVSS VectorVendor: lenovo

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch released

Apr 17, 2026 - 15:09 nvd

Patch available

Apr 16, 2026 - 05:29 EUVD

7.5.5.19

CVSS changed

Apr 15, 2026 - 15:22 NVD

7.8 (HIGH) 8.5 (HIGH)

CVE Published

Apr 15, 2026 - 12:28 nvd

HIGH 8.5

DescriptionCVE.org

During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.

Threat Intelligence Overview

EPSS Score

0.0%

Top 99% exploitable

Prevalence

Medium

installed on many Lenovo Windows systems for managing system updates, but not universal

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.