Advisoriesby IbisLenovoCVE-2026-15994
Lenovo Vantage: code execution
Fix: upgrade to 20.2026.20.0 or later (2 fixed versions below)
During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Commercial Vantage Product | < 20.2026.20.0 | 20.2026.20.0 |
| Vantage Product | < 10.2606.12 | 10.2606.12 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-59