Authentication Bypass in Lenovo System Update
CVE-2026-6387

7.3HIGH

Key Information:

Vendor

Lenovo
Status
System Update
Vendor
CVE Published:
13 August 2026

What is CVE-2026-6387?

A reported authentication bypass vulnerability in Lenovo System Update could enable an authenticated local user to perform actions that may lead to arbitrary code execution with elevated privileges. This flaw has the potential to compromise the integrity of the affected system, allowing malicious actors to exploit the vulnerability for unauthorized access.

Affected Version(s)

System Update Windows 0 < 5.08.04.85

References

https://support.lenovo.com/us/en/product_security/LEN-213316
vendor-advisory
https://support.lenovo.com/us/en/solutions/ht037099
productpatch

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lenovo thanks sf0rn for reporting this vulnerability.
.