Lenovo vulnerabilities
We track 109 vulnerabilities in Lenovo products across 60+ products. 109 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 11, 2026.
Latest Lenovo vulnerabilities
- 7.5 High severity
Lenovo LeCloud App improper input validation allows attackers to access arbitrary components…
Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure.
- 7.8 High severity
1Lenovo Preload Directory: Incorrect Default Permissions
A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account due to incorrect default privileges.
- 7.8 High severity
Lenovo System Update: Uncontrolled Search Path Element
An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges.
- 7.1 High severity
Vantage HardwareScan Plugin: Time-of-check Time-of-use (TOCTOU) Race Condition
A denial of service vulnerability was reported in Lenovo Vantage HardwareScan Plugin version 1.3.0.5 and earlier that could allow a local attacker to delete contents of an arbitrary directory under certain conditions.
- 7.8 High severity
Vantage SystemUpdate Plugin: Improper Privilege Management
A privilege elevation vulnerability was reported in the Lenovo Vantage SystemUpdate plugin version 2.0.0.212 and earlier that could allow a local attacker to execute arbitrary code with elevated privileges.
- 7.5 High severity
App Store: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by other unrelated applications.
- 8.8 High severity
Printer GM265DN (production date June 2022 and…: Out-of-bounds Write
A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing an illegal string to the server-side interface via a script, resulting in a stack overflow.
- 7.2 High severity
Lenovo XClarity Controller (XCC): Improper Neutralization of Special Elements used in an SQL Command
An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
- 8.1 High severity
Lenovo XClarity Controller (XCC): Missing Authorization
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
- 7.8 High severity
Elliptic Labs Virtual Lock Sensor: Incorrect Default Permissions
A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges.
- 7.8 High severity
HardwareScanPlugin: Out-of-bounds Write
A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45 that could allow a local user to execute code with elevated privileges.
- 7.8 High severity
BIOS: Incorrect Default Permissions
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- 7.8 High severity
ThinkPad: Not Failing Securely
A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to insecure settings if the BIOS becomes corrupt.
- 7.8 High severity
Universal Device Client (UDC): Uncontrolled Search Path Element
An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges.
- 7.5 High severity
Lenovo XClarity Administrator: Improper Restriction of XML External Entity Reference
An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files.
- 8.1 High severity
Lenovo XClarity Administrator: Improper Neutralization of Special Elements used in an SQL Command
A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a specific web API.
- 7.5 High severity
System Management Module (SMM): Asymmetric Resource Consumption (Amplification)
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.
- 7.8 High severity
ThinkStation BIOS: Out-of-bounds Write
A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.
- 7.8 High severity
ThinkStation BIOS: Out-of-bounds Write
An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access to elevate their privileges and execute arbitrary code.
- 7.8 High severity
ThinkPad Hybrid USB-C with USB-A Dock Firmware…: Incorrect Default Permissions
A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with local access to execute code with elevated privileges during the package upgrade or installation.
- 8.8 High severity
XClarity Controller: Use of Externally-Controlled Format String
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API.
- 8.8 High severity
A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could…
A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attacker with local network access.
- 7.8 High severity
Lenovo Drivers Management: Improper Access Control
A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a local user to execute code with elevated privileges.
- 8.8 High severity
XClarity Controller: Incorrect Default Permissions
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured
- 7.8 High severity
BIOS: Buffer Copy without Checking Size of Input
A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
- 7.8 High severity
BIOS: Buffer Copy without Checking Size of Input
A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
- 8.8 High severity
PCManager: Improper Neutralization of Special Elements used in an OS Command
A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specially crafted website.
- 7.8 High severity
System Update: Cleartext Storage of Sensitive Information in GUI
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of a System Update package released before 2022-02-25 that displ
- 9.8 Critical severity
Apache Struts Remote Code Execution Exploited
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted C