Lenovo System Update: Improper permissions allow local privilege escalation
Summary
An improper permissions vulnerability (CWE-276) in Lenovo System Update allows a local, authenticated user to execute code with elevated privileges. The CNA rates confidentiality, integrity and availability impact as high. Exploitation requires a logon on the affected machine and user interaction.
Affected
- Lenovo System Update 0 through 5.08.03.59
- Vendor CWE: CWE-276 (Incorrect Default Permissions)
Fixed in
- Unknown. The fixed version is not confirmed by a primary source; verify against LEN-232748. A third-party source mentions 5.08.04.85 or later, which is unverified for this CVE.
- Lenovo has declared System Update end of support as of October 31, 2026; no further fixes will be released.
Workaround
- Unknown. No vendor-documented workaround found.
- Limit local logon rights on shared or kiosk machines.
Exploitation
- In the wild: Not known.
- Public exploit: VulDB reports no public exploit or technical details (single source).
Our recommendation
- Inventory Lenovo endpoints for System Update.
- Uninstall Lenovo System Update, as recommended by Lenovo, and migrate to Lenovo Commercial Vantage.
- Prioritise shared or multi-user machines.
- Monitor for unexpected local privilege escalation activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Lenovo Product Security Advisory LEN-232748 support.lenovo.com
- Lenovo System Update download page support.lenovo.com
- CVE Record CVE-2026-77873 www.cve.org
- VulDB entry 435860 vuldb.com
- OffSeq threat radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:26.
Original description (NVD)
An improper permissions vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.