Lenovo security advisories

26 advisories · 17 critical or high in 12 months · latest Sep 10

26 advisories

Date	Advisory	Severity	Fixed in
Sep 10	Lenovo Health Application: hard-coded credentials Critical9.3Sep 10 CVE-2026-75940No fix yet	Critical9.3	No fix yet
Sep 10	Lenovo Software Fix: authentication bypass High8.5Sep 10 CVE-2026-634277.6.2.10	High8.5	7.6.2.10
Sep 10	Lenovo File Manager Application: improper authorization High8.4Sep 10 CVE-2026-189949.8.1.77	High8.4	9.8.1.77
Sep 10	Lenovo Tianxi AI Agent PC Application: command injection High8.4Sep 10 CVE-2026-191364.2.1.8111	High8.4	4.2.1.8111
Sep 10	Lenovo Filez Client application: insecure permissions High8.5Sep 10 CVE-2026-1181311.7.1.0+1 more	High8.5	11.7.1.0+1 more
Sep 2	Lenovo Smart Connect Application: missing authorization High7.3Sep 2 CVE-2026-180589.03.00.61	High7.3	9.03.00.61
Aug 13	Lenovo System Update: authentication bypass High7.3Aug 13 CVE-2026-63875.08.04.85	High7.3	5.08.04.85
Aug 13	Lenovo Accessories and Display Manager: code execution High8.5Aug 13 CVE-2026-634231.0.9	High8.5	1.0.9
Aug 13	Lenovo Dock Manager: privilege escalation High7.0Aug 13 CVE-2026-634241.6.5.3	High7.0	1.6.5.3
Aug 13	Lenovo Dock Manager: insecure permissions High8.5Aug 13 CVE-2026-634251.6.5.3	High8.5	1.6.5.3
Aug 13	Lenovo Dock Manager: arbitrary file write Medium6.9Aug 13 CVE-2026-634261.6.5.3	Medium6.9	1.6.5.3
Aug 13	Lenovo Vantage: code execution High7.3Aug 13 CVE-2026-1599420.2026.20.0+1 more	High7.3	20.2026.20.0+1 more
Aug 13	Lenovo E14 Gen 6 Laptops ELAN TrackPoi: out-of-bounds write Medium5.7Aug 13 CVE-2026-14256E16 Gen 2 (Type 21M5+3 more	Medium5.7	E16 Gen 2 (Type 21M5+3 more
Aug 13	Lenovo Vantage: arbitrary file write Medium6.9Aug 13 CVE-2026-120361.1.0.51	Medium6.9	1.1.0.51
Aug 4	Lenovo XClarity Essentials OneCLI: local low-privileged attacker could... Low1.0Aug 4 CVE-2026-167915.6	Low1.0	5.6
Aug 4	Lenovo XClarity Orchestrator: improper certificate validation High7.0Aug 4 CVE-2026-16792No fix yet	High7.0	No fix yet
Aug 4	Lenovo XClarity Orchestrator: improper input validation High8.7Aug 4 CVE-2026-167932.2.0	High8.7	2.2.0
Jul 16	Lenovo Legion Zone: insecure permissions High7.3Jul 16 CVE-2026-90462.0.26+1 more	High7.3	2.0.26+1 more
Jul 16	Lenovo Smart Connect: improper access control Medium6.8Jul 16 CVE-2026-651109.0.2.003.000	Medium6.8	09.0.2.003.000
Jul 16	Lenovo App Store: code execution High7.0Jul 16 CVE-2026-131049.0.2930.0514	High7.0	9.0.2930.0514
Jul 16	Lenovo XClarity Integrator for Microsoft Windows Admin Center: command injection High8.8Jul 16 CVE-2026-14371No fix yet	High8.8	No fix yet
Jul 16	Lenovo IdeaPad Pro 5 16AGP11 BIOS: out-of-bounds write Medium6.8Jul 16 CVE-2026-10589Yoga Pro 7 15IPH11 BIOS TNCN37WW+5 more	Medium6.8	Yoga Pro 7 15IPH11 BIOS TNCN37WW+5 more
Jul 16	Lenovo IdeaPad Pro 5 16AGP11 BIOS: missing authentication Medium6.7Jul 16 CVE-2026-10590Yoga Pro 7 15IPH11 BIOS TNCN37WW+5 more	Medium6.7	Yoga Pro 7 15IPH11 BIOS TNCN37WW+5 more
Jul 16	Lenovo App Store: path traversal High7.0Jul 16 CVE-2026-131039.0.2930.0514	High7.0	9.0.2930.0514
Jul 16	Lenovo IdeaPad Pro 5 16AGP11 BIOS: out-of-bounds write Medium6.8Jul 16 CVE-2026-10587Yoga Pro 7 15IPH11 BIOS TNCN37WW+5 more	Medium6.8	Yoga Pro 7 15IPH11 BIOS TNCN37WW+5 more
Jul 16	Lenovo IdeaPad Pro 5 16AGP11 BIOS: system information exposure Medium6.7Jul 16 CVE-2026-10588Yoga Pro 7 15IPH11 BIOS TNCN37WW+5 more	Medium6.7	Yoga Pro 7 15IPH11 BIOS TNCN37WW+5 more

About Lenovo

Security advisories Lenovo publishes for its own products.

support.lenovo.com/us/en/product_security/home Lenovo

Critical advisories by email