Which versions of Lenovo Dock Manager are affected by EUVD-2026-58059?

Lenovo Dock Manager (CVE-2026-63424, CVSS 7.0) contains a privilege escalation vulnerability enabling authenticated local users to achieve complete system compromise through extraction of a weakly…. A patch is available.

How to fix or mitigate EUVD-2026-58059?

Within 24 hours, inventory all systems running Lenovo Dock Manager across your organization and identify business-critical endpoints. Within 7 days, apply Lenovo's vendor patch from advisory LEN-223470 to all affected endpoints, prioritizing high-risk systems and those used by privileged users. Within 30 days, complete patch deployment verification through configuration audits and endpoint monitoring to ensure all instances are updated and local privilege escalation vectors are closed.

Lenovo Dock Manager EUVD-2026-58059

Q: What is the CVSS score of EUVD-2026-58059?

EUVD-2026-58059 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-63424 HIGH

Weak Encoding for Password (CWE-261)

2026-08-13 lenovo

GHSA-w45c-829m-rq5v

Privilege Escalation Lenovo Dock Manager

7.0

CVSS 4.0 · Vendor: lenovo

Severity by source

Vendor (lenovo) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Local vector and low-privilege requirement confirmed by description and CVSS 4.0 input; high integrity and availability impact from privilege escalation; low confidentiality impact per VC:L in source vector.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (lenovo).

CVSS VectorVendor: lenovo

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:49 vuln.today

CVE Published

Aug 13, 2026 - 14:52 cve.org

HIGH 7.0

DescriptionCVE.org

During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.

AnalysisAI

Privilege escalation in Lenovo Dock Manager exposes local authenticated users to full system compromise via an improperly protected cryptographic key, discovered during Lenovo's own internal security assessment. An attacker with a standard local user account can extract the weakly protected key and leverage it to elevate privileges on the affected endpoint. No public exploit has been identified at time of analysis; Lenovo has released a patch via advisory LEN-223470.

Technical ContextAI

Lenovo Dock Manager is endpoint software that manages Lenovo docking station peripherals, commonly deployed across enterprise fleets. CWE-261 (Weak Encoding for Password) identifies the root cause class: a cryptographic key or credential is stored or transmitted with insufficient protection - for example, using reversible encoding, weak access controls on key storage, or hardcoded key material accessible to low-privileged processes. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms a local attack surface requiring no special attack prerequisites, consistent with a key stored in a location readable by standard user accounts such as the Windows registry, a world-readable file, or an unprotected configuration store. The CPE string cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded a specific vulnerable version range - the Lenovo advisory must be consulted for exact affected versions.

RemediationAI

Apply the vendor-released patch for Lenovo Dock Manager as documented at https://support.lenovo.com/us/en/solutions/ht037099#dm, cross-referenced with the security advisory at https://support.lenovo.com/us/en/product_security/LEN-223470. The exact patched version number is not specified in the available input data and must be confirmed from the Lenovo advisory page before deployment. As a compensating control pending patching, enforce least-privilege user account policies on all endpoints running Dock Manager, ensuring standard users do not have access to service configuration directories or relevant registry hives. Monitoring for unexpected privilege escalation events via endpoint detection tooling can serve as a detection layer. Note that restricting file system or registry ACLs without full understanding of the key's storage location carries a risk of breaking Dock Manager functionality - validate in a test environment first.