68
CVEs
1
Critical
31
High
0
KEV
1
PoC
7
Unpatched C/H
64.7%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
31
MEDIUM
32
LOW
2
Monthly CVE Trend
Affected Products (30)
Linux Kernel
23
Thinkcentre M625Q Firmware
23
Thinkcentre M80T Firmware
22
Thinkcentre M90S Firmware
22
Thinkcentre M80S Firmware
22
Thinkcentre M90T Firmware
22
Ideacentre Gaming 5 14Iob6 Firmware
21
Ideacentre 5 14Iob6 Firmware
21
Thinkcentre M90Q Tiny Firmware
21
V50A 24Imb Firmware
21
Thinkcentre M70C Firmware
21
V50S 07Imb Firmware
21
Thinkcentre M75T Gen 2 Firmware
21
Ideacentre Creator 5 14Iob6 Firmware
21
Xclarity Administrator
21
V30A 22Iml Firmware
21
Thinkcentre M630E Firmware
21
V50A 22Imb Firmware
21
Thinkcentre M90A Firmware
21
Thinkcentre M75N Firmware
21
Thinkcentre M75S Gen 2 Firmware
21
Ideacentre 3 07Imb05 Firmware
21
Thinkcentre M80Q Firmware
21
Thinkcentre M70Q Firmware
21
Thinkcentre M70S Firmware
21
Ideacentre G5 14Imb05 Firmware
21
V50T 13Imb Firmware
21
Thinkcentre M70T Firmware
21
Ideacentre G5 14Amr05 Firmware
20
Thinkstation P520 Workstation Firmware
20
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-58583 | Local privilege escalation in the FluxInk (formerly Sunia SPB Peripheral) Color Management Driver TcnPeripheral64.sys version 1.0.7.2 lets a standard user map arbitrary physical memory via the \Device\PhysicalMemory object and gain kernel-level control. The flaw affects Lenovo systems shipping this signed color-management driver and is fixed in version 1.0.7.6. Publicly available exploit code exists; there is no public exploit identified as actively exploited (not in CISA KEV), though the vulnerability was reported by CISA (cisa-cg). | HIGH | 8.4 | 0.1% | 62 |
PoC
|
| CVE-2026-75940 | Sensitive health-data exposure in the Lenovo Health Android application (distributed exclusively in the Chinese market) stems from hardcoded credentials (CWE-798) that let an attacker access users' health-related information without legitimate authentication. Reported by Lenovo PSIRT and tracked under a single Lenovo advisory, it carries a CVSS 4.0 base of 9.3 driven by high confidentiality impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-14371 | PowerShell command injection in Lenovo XClarity Integrator for Microsoft Windows Admin Center (versions 5.1.1 and below) running on the WAC Gateway allows an authenticated low-privileged attacker to inject arbitrary PowerShell commands when the plugin establishes remote PowerShell sessions. Successful exploitation yields high-impact code execution that extends beyond the plugin into subsequent systems (managed hosts), with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.8 | 0.8% | 44 |
No patch
|
| CVE-2026-16793 | OS command injection in Lenovo XClarity Orchestrator (LXCO) 2.2.0 enables an authenticated low-privileged attacker to execute arbitrary operating system commands with elevated privileges under a specific, undisclosed circumstance. LXCO is an enterprise data center orchestration platform that manages Lenovo server and chassis infrastructure, making successful exploitation highly impactful to infrastructure availability, integrity, and confidentiality. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Lenovo advisory. | HIGH | 8.7 | 0.4% | 44 |
|
| CVE-2026-6281 | Remote command execution in Lenovo Personal Cloud Storage devices (T1, T2, T2S, T2Pro, X1, X1S, A1, A1S, and Home Storage Hub T20/X20) allows authenticated users on the local network to execute arbitrary commands via OS command injection (CWE-78). The CVSS v4.0 score of 8.7 reflects complete system compromise potential (VC:H/VI:H/VA:H) through network attack with low complexity but requiring low-privilege authentication (AV:N/AC:L/PR:L). No evidence of active exploitation (not in CISA KEV) or public exploit code identified at time of analysis. Lenovo has issued advisories including end-of-life notices for certain models (T1), indicating some affected products may not receive patches. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-6282 | Path traversal in Lenovo Personal Cloud Storage devices allows authenticated remote attackers to move or access files belonging to other users on the same device, enabling unauthorized data disclosure and modification across user boundaries. Affects multiple product lines including Personal Cloud (T1, T2, T2S, T2Pro, X1, X1S, A1, A1S) and Home Storage Hub (T20, X20). CVSS 8.6 reflects high confidentiality and integrity impact with low attack complexity. No active exploitation confirmed in CISA KEV at time of analysis, and EPSS data not available for this 2026 CVE identifier. | HIGH | 8.6 | 0.1% | 43 |
|
| CVE-2026-63423 | Privilege escalation in Lenovo Accessories and Display Manager for Enterprise for Windows allows a local authenticated user with low-level privileges to execute arbitrary code at elevated privilege levels, stemming from a hard-coded cryptographic key (CWE-321). The vulnerability was surfaced during an internal Lenovo security assessment and affects all versions of the product per the CPE wildcard. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor patch is confirmed available via Lenovo advisory LEN-213038. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-63427 | Local privilege escalation in Lenovo Rescue and Smart Assistant (LMSA) enables a local authenticated user to execute arbitrary code with elevated privileges by exploiting a capture-and-replay authentication bypass (CWE-290) in the application's privileged service layer. The vulnerability is strictly local in scope per the CVSS 4.0 vector (AV:L/PR:L), limiting the threat to attackers who already hold a standard user account on an affected Lenovo device. Lenovo has published advisory LEN-217409 with remediation guidance; no public exploit has been identified at time of analysis. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-63425 | Privilege escalation in Lenovo Dock Manager allows a local authenticated user to execute arbitrary code with elevated privileges by exploiting improper file or directory permissions (CWE-276). The flaw was identified during Lenovo's own internal security assessment, suggesting proactive vendor discovery rather than external researcher or attacker-driven disclosure. No public exploit code has been identified at time of analysis, and the local-only attack vector (AV:L, PR:L) meaningfully constrains real-world exposure compared to network-exploitable vulnerabilities, though enterprise environments with shared Lenovo workstations should treat this as a genuine privilege escalation risk. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-11813 | Privilege escalation in the Lenovo Filez Client application allows a local authenticated user to gain elevated system rights via improper file or directory permissions (CWE-276). The CVSS 4.0 score of 8.5 reflects a meaningful local attack path with low complexity and no special attack requirements, though exploitation is bounded by the requirement for an existing local foothold. No active exploitation or public proof-of-concept has been identified at time of analysis. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-4145 | Local privilege escalation in Lenovo Software Fix versions prior to 7.5.5.19 allows an authenticated local attacker to execute arbitrary code with elevated privileges via argument injection. While the CVSS 4.0 score is 8.5, exploitation requires local authenticated access and no active exploitation or public exploit is known; EPSS probability is extremely low (0.01%). | HIGH | 8.5 | 0.0% | 43 |
|
| CVE-2026-8637 | Local privilege escalation in Lenovo's LanSchool Classic client application allows authenticated users on affected endpoints to execute arbitrary code with elevated privileges via an uncontrolled search path (CWE-427). The flaw carries a CVSS 4.0 score of 8.5 with high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Because LanSchool Classic is widely deployed in K-12 and education environments, exploitation could let a student or low-privileged user gain SYSTEM-level control of managed classroom devices. | HIGH | 8.5 | 0.0% | 42 |
|
| CVE-2026-9045 | Local privilege escalation in Lenovo Accessories and Display Manager for Enterprise on Windows allows an authenticated low-privileged user to execute arbitrary code with elevated privileges, per a Lenovo-disclosed internal finding (LEN-213623). The CVSS 4.0 base score of 8.5 reflects high impact to confidentiality, integrity, and availability of the vulnerable system, though no public exploit identified at time of analysis. The CWE-306 (Missing Authentication for Critical Function) classification combined with the 'Authentication Bypass' tag suggests a privileged operation in the product is reachable without proper access checks. | HIGH | 8.5 | 0.0% | 42 |
|
| CVE-2026-18994 | Improper export of Android application components in Lenovo File Manager (Chinese-market distribution) enables a locally authenticated user or co-installed application to read or modify files that the application designates as protected. The root cause is CWE-926, where one or more Android components - likely a content provider or activity - are exported without enforcing the application's own authorization logic. No public exploit code exists and the vulnerability has not been added to CISA KEV; however, the CVSS 4.0 score of 8.4 reflects genuine high-impact file access if an attacker can install a companion malicious application on the target device. | HIGH | 8.4 | 0.1% | 42 |
|
| CVE-2025-10237 | Arbitrary privileged memory read/write in Lenovo ThinkPad embedded controller (EC) firmware allows a local administrator on affected ThinkPad models (X13 Gen 6, X1 Carbon 13th Gen, P16v Gen 3, L16 Gen 1/2, T14s Gen 6, P14s Gen 6, L13 Gen 6, L14 Gen 6) to access or modify protected memory regions. Discovered during Lenovo's internal security assessment, the issue is rated CVSS 4.0 8.4 (High) and there is no public exploit identified at time of analysis, with no CISA KEV listing. Despite the high score, exploitation requires high privileges and local access, narrowing realistic abuse to attackers who already have admin on the host or to supply-chain/insider scenarios. | HIGH | 8.4 | 0.0% | 42 |
|