Description
A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.
Published: 2026-08-13
Score: 7.3 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A local authentication bypass flaw allows a user with access to Lenovo System Update to run arbitrary code with elevated privileges. This results in full control over the affected Windows machine, compromising confidentiality, integrity, and availability. The weakness is identified as CWE‑290.

Affected Systems

Lenovo System Update for Windows is impacted. Versions older than 5.08.04.85 are vulnerable and can be exploited by a local authenticated user.

Risk and Exploitability

The CVSS score of 7.3 marks the vulnerability as high severity. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, yet it remains a local threat. Once the authentication check is bypassed, an attacker can achieve privilege escalation by executing arbitrary code. Applying the vendor update eliminates the risk.

Generated by OpenCVE AI on August 13, 2026 at 17:09 UTC.

Remediation

Vendor Solution

Update Lenovo System Update to version 5.08.04.85 or later.

OpenCVE Recommended Actions

  • Update Lenovo System Update to version 5.08.04.85 or later.
  • Disable driver update features that are not required to reduce the attack surface.
  • Monitor system logs for abnormal code execution or signs of privilege escalation.

Generated by OpenCVE AI on August 13, 2026 at 17:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation via Authentication Bypass in Lenovo System Update

Thu, 13 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Description A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.
First Time appeared Lenovo
Lenovo system Update
Weaknesses CWE-290
CPEs cpe:2.3:a:lenovo:system_update:*:*:windows:*:*:*:*:*
Vendors & Products Lenovo
Lenovo system Update
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Lenovo System Update
cve-icon MITRE

Status: PUBLISHED

Assigner: lenovo

Published:

Updated: 2026-08-13T16:07:44.922Z

Reserved: 2026-04-15T19:22:25.659Z

Link: CVE-2026-6387

cve-icon Vulnrichment

Updated: 2026-08-13T16:07:41.761Z

cve-icon NVD

Status : Received

Published: 2026-08-13T15:19:58.590

Modified: 2026-08-13T16:18:56.283

Link: CVE-2026-6387

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T17:45:03Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing