Lenovo System Update CVE-2026-6387

Exploitation requires a locally authenticated user account with at minimum standard (low) privileges on the target Windows machine - confirmed by the CVSS 4.0 PR:L metric. Lenovo System Update must be installed and its privileged service component must be present and accessible on the host, as indicated by the AT:P (Attack Requirements: Present) metric. The attack is strictly limited to the local attack surface (AV:L), ruling out remote unauthenticated exploitation. Remote attackers would first need to establish local access through a separate vector (e.g., initial compromise, RDP session) before this vulnerability becomes exploitable. No user interaction from a higher-privileged user is required (UI:N), meaning the attack can be executed autonomously once local access is established.

The CVSS 4.0 score of 7.3 (High) reflects a meaningful but locally scoped threat. The AV:L (Local) metric confirms the attack cannot be launched remotely without prior foothold - an attacker must already have shell access or physical access to the device. PR:L indicates low-privilege (standard user) authentication is sufficient, meaning no admin account is needed. The AT:P (Attack Requirements: Present) flag signals that specific conditions - likely the System Update service being installed and active - must be met, modestly raising the bar above a trivially exploitable flaw. The VC:H/VI:H/VA:H impact metrics indicate full compromise of the vulnerable system is achievable upon successful exploitation. There is no CISA KEV listing and no publicly available proof-of-concept code identified, which meaningfully reduces near-term opportunistic risk. The realistic threat model is a malicious insider, a compromised low-privilege account, or post-exploitation lateral movement on a Lenovo endpoint - not mass remote exploitation. Priority should be elevated for organizations with shared Lenovo workstations or where endpoint security posture assumes standard users are untrusted.

An attacker with a low-privilege local account on a Lenovo device - obtained via phishing, credential theft, or insider access - invokes or interacts with the Lenovo System Update service, crafting a spoofed identity or bypassing its authentication check to impersonate a privileged caller. The service, deceived into treating the request as authorized, executes attacker-supplied code in its elevated context, granting the attacker full control of the system. No public proof-of-concept code has been identified at time of analysis.