30
CVEs
1
Critical
15
High
0
KEV
1
PoC
2
Unpatched C/H
80.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
15
MEDIUM
11
LOW
1
Monthly CVE Trend
Affected Products (30)
Linux Kernel
23
Thinkcentre M625Q Firmware
23
Thinkcentre M80T Firmware
22
Thinkcentre M90S Firmware
22
Thinkcentre M80S Firmware
22
Thinkcentre M90T Firmware
22
Ideacentre Gaming 5 14Iob6 Firmware
21
Ideacentre 5 14Iob6 Firmware
21
Thinkcentre M90Q Tiny Firmware
21
V50A 24Imb Firmware
21
Thinkcentre M70C Firmware
21
V50S 07Imb Firmware
21
Thinkcentre M75T Gen 2 Firmware
21
Ideacentre Creator 5 14Iob6 Firmware
21
Xclarity Administrator
21
V30A 22Iml Firmware
21
Thinkcentre M630E Firmware
21
V50A 22Imb Firmware
21
Thinkcentre M90A Firmware
21
Thinkcentre M75N Firmware
21
Thinkcentre M75S Gen 2 Firmware
21
Ideacentre 3 07Imb05 Firmware
21
Thinkcentre M80Q Firmware
21
Thinkcentre M70Q Firmware
21
Thinkcentre M70S Firmware
21
Ideacentre G5 14Imb05 Firmware
21
V50T 13Imb Firmware
21
Thinkcentre M70T Firmware
21
Ideacentre G5 14Amr05 Firmware
20
Thinkstation P520 Workstation Firmware
20
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-58583 | Local privilege escalation in the FluxInk (formerly Sunia SPB Peripheral) Color Management Driver TcnPeripheral64.sys version 1.0.7.2 lets a standard user map arbitrary physical memory via the \Device\PhysicalMemory object and gain kernel-level control. The flaw affects Lenovo systems shipping this signed color-management driver and is fixed in version 1.0.7.6. Publicly available exploit code exists; there is no public exploit identified as actively exploited (not in CISA KEV), though the vulnerability was reported by CISA (cisa-cg). | HIGH | 8.4 | 0.1% | 62 |
PoC
|
| CVE-2026-75940 | Sensitive health-data exposure in the Lenovo Health Android application (distributed exclusively in the Chinese market) stems from hardcoded credentials (CWE-798) that let an attacker access users' health-related information without legitimate authentication. Reported by Lenovo PSIRT and tracked under a single Lenovo advisory, it carries a CVSS 4.0 base of 9.3 driven by high confidentiality impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-14371 | PowerShell command injection in Lenovo XClarity Integrator for Microsoft Windows Admin Center (versions 5.1.1 and below) running on the WAC Gateway allows an authenticated low-privileged attacker to inject arbitrary PowerShell commands when the plugin establishes remote PowerShell sessions. Successful exploitation yields high-impact code execution that extends beyond the plugin into subsequent systems (managed hosts), with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.8 | 0.8% | 44 |
No patch
|
| CVE-2026-16793 | OS command injection in Lenovo XClarity Orchestrator (LXCO) 2.2.0 enables an authenticated low-privileged attacker to execute arbitrary operating system commands with elevated privileges under a specific, undisclosed circumstance. LXCO is an enterprise data center orchestration platform that manages Lenovo server and chassis infrastructure, making successful exploitation highly impactful to infrastructure availability, integrity, and confidentiality. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Lenovo advisory. | HIGH | 8.7 | 0.4% | 44 |
|
| CVE-2026-63423 | Privilege escalation in Lenovo Accessories and Display Manager for Enterprise for Windows allows a local authenticated user with low-level privileges to execute arbitrary code at elevated privilege levels, stemming from a hard-coded cryptographic key (CWE-321). The vulnerability was surfaced during an internal Lenovo security assessment and affects all versions of the product per the CPE wildcard. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor patch is confirmed available via Lenovo advisory LEN-213038. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-63427 | Local privilege escalation in Lenovo Rescue and Smart Assistant (LMSA) enables a local authenticated user to execute arbitrary code with elevated privileges by exploiting a capture-and-replay authentication bypass (CWE-290) in the application's privileged service layer. The vulnerability is strictly local in scope per the CVSS 4.0 vector (AV:L/PR:L), limiting the threat to attackers who already hold a standard user account on an affected Lenovo device. Lenovo has published advisory LEN-217409 with remediation guidance; no public exploit has been identified at time of analysis. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-63425 | Privilege escalation in Lenovo Dock Manager allows a local authenticated user to execute arbitrary code with elevated privileges by exploiting improper file or directory permissions (CWE-276). The flaw was identified during Lenovo's own internal security assessment, suggesting proactive vendor discovery rather than external researcher or attacker-driven disclosure. No public exploit code has been identified at time of analysis, and the local-only attack vector (AV:L, PR:L) meaningfully constrains real-world exposure compared to network-exploitable vulnerabilities, though enterprise environments with shared Lenovo workstations should treat this as a genuine privilege escalation risk. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-11813 | Privilege escalation in the Lenovo Filez Client application allows a local authenticated user to gain elevated system rights via improper file or directory permissions (CWE-276). The CVSS 4.0 score of 8.5 reflects a meaningful local attack path with low complexity and no special attack requirements, though exploitation is bounded by the requirement for an existing local foothold. No active exploitation or public proof-of-concept has been identified at time of analysis. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-18994 | Improper export of Android application components in Lenovo File Manager (Chinese-market distribution) enables a locally authenticated user or co-installed application to read or modify files that the application designates as protected. The root cause is CWE-926, where one or more Android components - likely a content provider or activity - are exported without enforcing the application's own authorization logic. No public exploit code exists and the vulnerability has not been added to CISA KEV; however, the CVSS 4.0 score of 8.4 reflects genuine high-impact file access if an attacker can install a companion malicious application on the target device. | HIGH | 8.4 | 0.1% | 42 |
|
| CVE-2026-15994 | Privilege escalation via symlink following in Lenovo Vantage and Lenovo Commercial Vantage allows a local authenticated user to execute arbitrary code with elevated privileges on affected Lenovo systems. Discovered during an internal Lenovo security assessment, the flaw (CWE-59) arises when a privileged Vantage component resolves attacker-controlled symbolic links without validation, enabling redirection of file operations to security-sensitive targets. No public exploit code or active exploitation has been confirmed at time of analysis; CVSS 4.0 scores this at 7.3 with a local attack vector and specific attack requirements present. | HIGH | 7.3 | 0.2% | 37 |
|
| CVE-2026-6387 | Lenovo System Update contains an authentication bypass (CWE-290) that permits a locally authenticated standard user to circumvent privilege checks and execute arbitrary code with elevated system privileges. Affected products span all tracked versions per CPE data, with Lenovo confirming the issue and releasing a patch under advisory LEN-213316. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting immediate threat to environments where adversaries already have local user access. | HIGH | 7.3 | 0.1% | 37 |
|
| CVE-2026-9046 | Local code execution in Lenovo Legion Zone and the Lenovo App Store (China-market Windows builds) allows an authenticated local user to run arbitrary code when either application is installed on a non-system partition. The flaw stems from insecure directory/file permissions (CWE-277) that a low-privileged user can abuse to plant or modify executable content later run with higher privilege. No public exploit is identified at time of analysis and it is not listed in CISA KEV; impact is confined to systems where these Chinese-market Lenovo utilities are deployed to a non-default drive. | HIGH | 7.3 | 0.1% | 36 |
|
| CVE-2026-63424 | Privilege escalation in Lenovo Dock Manager exposes local authenticated users to full system compromise via an improperly protected cryptographic key, discovered during Lenovo's own internal security assessment. An attacker with a standard local user account can extract the weakly protected key and leverage it to elevate privileges on the affected endpoint. No public exploit has been identified at time of analysis; Lenovo has released a patch via advisory LEN-223470. | HIGH | 7.0 | 0.1% | 35 |
|
| CVE-2026-16792 | Improper TLS certificate validation in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices exposes sensitive management communications to interception by an adjacent network attacker capable of positioning themselves for a machine-in-the-middle attack. The flaw (CWE-295) allows the attacker to bypass HTTPS trust enforcement under unspecified triggering circumstances, potentially capturing credentials, tokens, or orchestration data exchanged between LXCO microservices. No public exploit code or CISA KEV listing exists at time of analysis; Lenovo has released a patch via advisory HT509976. | HIGH | 7.0 | 0.1% | 35 |
|
| CVE-2026-13103 | Local code execution in Lenovo App Store (Chinese-market distribution only) lets an authenticated local user abuse a path traversal weakness to write or load files outside intended directories and run arbitrary code. The flaw was self-reported by Lenovo and carries a CVSS 4.0 base score of 7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high to confidentiality, integrity, and availability of the local system, but exploitation requires existing low-privilege local access plus user interaction. | HIGH | 7.0 | 0.1% | 35 |
|