Lenovo SmartConnect Auth Bypass: Local Auth User Escalates Privileges Windows
CVE-2026-6090 Published on June 10, 2026
A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.
Vulnerability Analysis
CVE-2026-6090 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Authentication Bypass by Spoofing
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.
Products Associated with CVE-2026-6090
Want to know whenever a new CVE is published for Lenovo Smart Connect? stack.watch will email you.
Affected Versions
Lenovo Smart Connect:- Before 09.0.2.003.000 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.