Lenovo PC Manager: Incorrect default permissions enable local privilege escalation
Summary
Lenovo PC Manager, a Windows utility distributed exclusively in the Chinese market, contains a vulnerability caused by incorrect default permissions (CWE-276). A local user with standard privileges can exploit it to escalate privileges on the affected system. Exploitation requires an existing local user session and no user interaction; it is not a remote attack vector.
Affected
- Lenovo PC Manager versions from 0 before 5.1.210
- Default configuration: unaffected versions are 5.1.210 and later
Fixed in
- Update Lenovo PC Manager to version 5.1.210 or later
Workaround
- Unknown. No vendor workaround was found in the sources reviewed. Check the Lenovo advisory for official guidance.
- Until patched, restrict local standard users where possible.
Exploitation
- OffSeq reports the vulnerability as not known to be exploited.
- No public proof of concept found.
- CISA KEV status not verified.
Our recommendation
- Check whether any endpoint runs Lenovo PC Manager and record its version.
- Update to version 5.1.210 or later where the software is present, after verifying the version against the Lenovo advisory.
- Check the Lenovo advisory for an official workaround and updated scoring.
- Recheck NVD, CISA KEV and the Lenovo advisory after a few days for changes in exploitation status.
- Swiss relevance is likely low, but verify devices bought in or imported from China.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-89061 www.cve.org
- Lenovo advisory (iknow) iknow.lenovo.com.cn
- VulDB entry 435856 vuldb.com
- OffSeq threat radar CVE-2026-89061 radar.offseq.com
- ThreatInt CVE-2026-89061 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:21.
Original description (NVD)
During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager, distributed exclusively in the Chinese market, that could allow a local user to escalate privileges.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.