Lenovo vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-92629 A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a locHigh 7 · Oct 15, 2026
• CVE-2026-89057 A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device accHigh 7 · Oct 15, 2026
• CVE-2026-75941 A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on theHigh 8.6 · Oct 15, 2026
• CVE-2026-75940 A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitiCritical 9.3 · Sep 10, 2026
• CVE-2026-63427 An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution witHigh 8.5 · Sep 10, 2026
• CVE-2026-19136 A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow High 8.4 · Sep 10, 2026
• CVE-2026-18994 A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, thaHigh 8.4 · Sep 10, 2026
• CVE-2026-11813 A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate priviHigh 8.5 · Sep 10, 2026
• CVE-2026-6387 A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with High 7.3 · Aug 13, 2026
• CVE-2026-63425 During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticaHigh 8.5 · Aug 13, 2026
• CVE-2026-63424 During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalatHigh 7 · Aug 13, 2026
• CVE-2026-63423 During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that couldHigh 8.5 · Aug 13, 2026
• CVE-2026-15994 During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allowHigh 7.3 · Aug 13, 2026
• CVE-2026-16793 An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that High 8.7 · Aug 4, 2026
• CVE-2026-16792 An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent nHigh 7 · Aug 4, 2026
• CVE-2026-9046 A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the ChineseHigh 7.3 · Jul 16, 2026
• CVE-2026-14371 The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershell Command Injection High 8.8 · Jul 16, 2026
• CVE-2026-13104 A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to executHigh 7 · Jul 16, 2026
• CVE-2026-13103 A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticatedHigh 7 · Jul 16, 2026
• CVE-2026-9045 During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that couldHigh 8.5 · Jun 10, 2026
• CVE-2026-8637 A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to execuHigh 8.5 · Jun 10, 2026
• CVE-2026-6090 A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticated user to execute arbitrary code with elHigh 7.3 · Jun 10, 2026
• CVE-2025-10238 During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileHigh 8.4 · Jun 10, 2026
• CVE-2025-10237 During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could allow a privileged locHigh 8.4 · Jun 10, 2026
• CVE-2026-6282 A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user High 8.6 · May 13, 2026