Which versions of Lenovo System Update are affected by CVE-2026-6387?

Lenovo System Update contains a privilege escalation vulnerability (CVE-2026-6387, CVSS 7.3) affecting all Lenovo endpoints, enabling any employee or attacker with local access to gain administrative…. A patch is available.

How to fix or mitigate CVE-2026-6387?

Within 24 hours: inventory all systems running Lenovo System Update and identify current deployment status across your organization; obtain the latest patch version from Lenovo advisory LEN-213316. Within 7 days: deploy the available patch to all affected systems using your patch management process, prioritizing systems with standard user access or remote access exposure; verify successful deployment through endpoint management tools. Within 30 days: complete organization-wide patch deployment, conduct verification scans to confirm all systems have been updated, and review endpoint logs for any privilege escalation activity that occurred prior to patching.

Lenovo System Update CVE-2026-6387

Q: What is the CVSS score of CVE-2026-6387?

CVE-2026-6387 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-58055 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-08-13 lenovo

GHSA-5j74-5rwg-pcwv

Authentication Bypass RCE Lenovo System Update

7.3

CVSS 4.0 · Vendor: lenovo

Severity by source

Vendor (lenovo) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local vector and low privilege required since a standard authenticated user is the attacker; no scope change as impact is confined to the vulnerable host; high C/I/A reflects arbitrary code execution potential.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (lenovo).

CVSS VectorVendor: lenovo

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:46 vuln.today

CVE Published

Aug 13, 2026 - 14:52 cve.org

HIGH 7.3

DescriptionCVE.org

A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.

AnalysisAI

Lenovo System Update contains an authentication bypass (CWE-290) that permits a locally authenticated standard user to circumvent privilege checks and execute arbitrary code with elevated system privileges. Affected products span all tracked versions per CPE data, with Lenovo confirming the issue and releasing a patch under advisory LEN-213316. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting immediate threat to environments where adversaries already have local user access.

Technical ContextAI

CWE-290 (Authentication Bypass by Spoofing) describes a class of flaws where an attacker deceives a trust mechanism - such as a privileged service or inter-process communication channel - into treating a less-privileged or unauthorized request as legitimate. Lenovo System Update is a Windows application pre-installed on Lenovo consumer and commercial devices, responsible for downloading and applying drivers, firmware, and software packages. Its updater service typically runs under elevated privileges (SYSTEM or admin context) to perform system-level modifications. The vulnerability likely involves an attacker manipulating the authentication or identity-verification step between the low-privileged user-facing component and the privileged backend service - for example, by spoofing a token, COM interface, or named-pipe client identity - causing the service to execute attacker-supplied code in a privileged context. The CPE string cpe:2.3:a:lenovo:system_update:*:*:*:*:*:*:*:* confirms all versions are in scope per NVD data.

RemediationAI

Apply the vendor-released patch per Lenovo advisory LEN-213316, available at https://support.lenovo.com/us/en/product_security/LEN-213316, with the patched System Update package accessible at https://support.lenovo.com/us/en/solutions/ht037099. Exact patched version numbers should be confirmed directly from the Lenovo advisory, as no specific fix version is derivable from the CPE data alone. As a compensating control prior to patching, organizations can restrict local user execution rights, enforce application allowlisting to block unauthorized invocations of System Update components, and monitor for unexpected privilege escalation events on Lenovo endpoints via EDR tooling. Removing or disabling Lenovo System Update entirely is a viable workaround for environments that manage driver and firmware updates through centralized tooling (e.g., SCCM, Intune), with the trade-off of losing automated update delivery for that device class.