EUVD-2026-36049
GHSA-q34g-8v67-vv99
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 10, 2026
Privilege escalation in Lenovo Smart Connect for Windows allows a local authenticated user to bypass authentication checks and execute arbitrary code with elevated privileges. The flaw stems from an authentication bypass weakness (CWE-290) in the Windows client and carries a CVSS 4.0 score of 7.3. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Earlier versions of this analysis (2)
Local privilege escalation in Lenovo Smart Connect for Windows allows an authenticated user to bypass authentication controls and execute arbitrary code with elevated privileges. The vulnerability, tracked as CVE-2026-6090 and rated CVSS 7.3 (CVSS:4.0), was reported by Lenovo itself and currently has no public exploit identified at time of analysis. Exploitation requires local access plus a present attack requirement (AT:P), suggesting non-trivial conditions must be met.
Local privilege escalation in Lenovo Smart Connect for Windows allows an authenticated user to bypass authentication checks and execute arbitrary code with elevated privileges on the host. The flaw was reported directly by Lenovo (LEN-218281) and carries a CVSS 7.0 score; no public exploit identified at time of analysis and it is not listed in CISA KEV. The high attack complexity tempers what would otherwise be straightforward post-access privilege abuse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Smart Connect gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (lenovo) · only source for this CVE.
CVSS VectorVendor: lenovo
Lifecycle Timeline
5DescriptionCVE.org
A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.
Executive ViewAI
Lenovo Smart Connect for Windows (CVE-2026-6090) allows authenticated local users to escalate privileges and execute arbitrary code. Organizations using this application face system compromise risk with no vendor patch available. Immediate mitigation is required.
Within 24 hours: Inventory all systems running Lenovo Smart Connect for Windows and assess business criticality. Within 7 days: Implement compensating controls including restricting local administrator access, disabling Smart Connect if not essential, and enabling application whitelisting. Within 30 days: Establish monitoring for vendor patches (contact Lenovo for ETA) and plan immediate deployment once available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable Lenovo Smart Connect if not operationally required; (2) Restrict local system access to trusted users only; (3) Implement application whitelisting to prevent unauthorized code execution; (4) Enable audit logging for privilege escalation attempts; (5) Restrict user account privileges where feasible; (6) Monitor Smart Connect process execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Smart Connect
View allThe Lenovo Virtual Bus driver in Smart Connect contains a buffer overflow that allows local authenticated users to corru
Lenovo Smart Connect for Windows exposes an improper access control flaw that permits a local authenticated user to read
The Lenovo Virtual Bus driver in Smart Connect contains a divide-by-zero flaw that enables local authenticated users to
Exploit-DB