Lenovo System Update Auth Bypass Enables Local Priv Esc
CVE-2026-6387 Published on August 13, 2026
A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.
Vulnerability Analysis
CVE-2026-6387 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Authentication Bypass by Spoofing
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.
Products Associated with CVE-2026-6387
Want to know whenever a new CVE is published for Lenovo System Update? stack.watch will email you.
Affected Versions
Lenovo System Update:- Before 5.08.04.85 is affected.