Lenovo vulnerabilities and fixes

CVEs that mention Lenovo, ranked by priority. 9 tracked.

Lenovo has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-08-13. Highest priority: CVE-2026-16793 (score 42/100).

• CVE-2026-16793 HIGH 8.8 An improper neutralization of special elements used in an operating system command vulnerability was reported
• CVE-2026-63423 HIGH 7.8 During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Dis
• CVE-2026-63425 HIGH 7.8 UPGRADE During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenov
• CVE-2026-12036 HIGH 7.1 An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Co
• CVE-2026-63424 HIGH 7.3 UPGRADE During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that
• CVE-2026-63426 HIGH 7.1 UPGRADE During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that c
• CVE-2026-6387 HIGH 7.0 A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local
• CVE-2026-16792 MEDIUM 6.1 An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO)
• CVE-2026-16791 LOW 3.9 A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI 5.5.0 and be

FAQ

How do I fix Lenovo vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Lenovo being exploited right now?

None of the tracked Lenovo CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Lenovo CVE should I patch first?

CVE-2026-16793 currently ranks highest (42/100): An improper neutralization of special elements used in an operating system command vulnerability was reported .

← Back to latest CVEs