CVE-2026-77873

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77873", "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "state": "PUBLISHED", "assignerShortName": "lenovo", "dateReserved": "2026-08-21T15:10:58.579Z", "datePublished": "2026-11-11T16:15:32.544Z", "dateUpdated": "2026-11-11T16:15:32.544Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo", "dateUpdated": "2026-11-11T16:15:32.544Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-276", "description": "CWE-276: Incorrect Default Permissions", "type": "CWE"}]}], "affected": [{"vendor": "Lenovo", "product": "System Update", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "5.08.03.59", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:lenovo:system_update:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "5.08.03.59"}]}]}], "descriptions": [{"lang": "en", "value": "An improper permissions vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An improper permissions vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges."}]}], "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-232748", "tags": ["vendor-advisory"]}, {"url": "https://support.lenovo.com/us/en/downloads/ds012808", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "As of October 31, 2026, Lenovo System Update has reached end of support status, and no further updates will be released to address these vulnerabilities. \u00a0Lenovo recommends that users uninstall Lenovo System Update as soon as possible and migrate to Lenovo Commercial Vantage ( Lenovo Commercial Vantage - Lenovo Support US https://support.lenovo.com/us/en/solutions/hf003321 ).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>As of October 31, 2026, Lenovo System Update has reached end of support status, and no further updates will be released to address these vulnerabilities. &nbsp;Lenovo recommends that users uninstall Lenovo System Update as soon as possible and migrate to Lenovo Commercial Vantage (<a href=\"https://support.lenovo.com/us/en/solutions/hf003321\" target=\"_blank\" rel=\"nofollow noopener\" title=\"Follow link\">Lenovo Commercial Vantage - Lenovo Support US</a>).</p>"}]}], "credits": [{"lang": "en", "value": "Lenovo thanks sf0rn for reporting this vulnerability.", "type": "finder"}, {"lang": "en", "value": "Lenovo thanks Nicholas Ineson \u2013 Forefront IT Security Services Ltd for subsequently reporting this vulnerability.", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0-beta"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "System Update", "vendor": "Lenovo", "versions": [{"lessThanOrEqual": "5.08.03.59", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@lenovo.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper permissions vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges."}], "id": "CVE-2026-77873", "lastModified": "2026-11-12T22:09:39.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "psirt@lenovo.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@lenovo.com", "type": "Secondary"}]}, "published": "2026-11-11T17:17:19.940", "references": [{"source": "psirt@lenovo.com", "url": "https://support.lenovo.com/us/en/downloads/ds012808"}, {"source": "psirt@lenovo.com", "url": "https://support.lenovo.com/us/en/product_security/LEN-232748"}], "sourceIdentifier": "psirt@lenovo.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "psirt@lenovo.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.08.03.59]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "System Update", "source": "cna", "vendor": "Lenovo"}, "product": "system_update", "vendor": "lenovo"}], "created": "2026-11-12T21:15:09.129303+00:00", "title": "Improper Permissions Allowing Local Authenticated Users to Execute Code with Elevated Privileges in Lenovo System Update", "updated": "2026-11-13T08:00:07.159806+00:00", "vendors": ["lenovo", "lenovo$PRODUCT$system_update"]}