Improper Permissions Flaw in Lenovo System Update
CVE-2026-77873

7HIGH

Key Information:

Vendor

Lenovo
Status
System Update
Vendor
CVE Published:
11 November 2026

What is CVE-2026-77873?

An improper permissions vulnerability exists within Lenovo System Update that may allow a local authenticated user to execute arbitrary code with elevated privileges. This flaw can lead to unauthorized access and control over the system, posing significant security risks for users. Proper remediation is required to safeguard against potential exploitation.

Affected Version(s)

System Update 0 <= 5.08.03.59

References

https://support.lenovo.com/us/en/product_security/LEN-232748
vendor-advisory
https://support.lenovo.com/us/en/downloads/ds012808
product

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lenovo thanks sf0rn for reporting this vulnerability.
Lenovo thanks Nicholas Ineson – Forefront IT Security Services Ltd for subsequently reporting this vulnerability.
.