Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.5
CVE-2026-63427: Lenovo Software Fix lets signed‑in users gain admin rights
CVE-2026-63427 · published 1 month ago
Summary
The Lenovo Software Fix program can be tricked by someone who is already logged in on the computer to run any code they choose with higher, administrator‑level privileges. This could let a malicious insider install unwanted software or change system settings. Apply the latest update from Lenovo or restrict local user permissions to mitigate the risk.
What to do
- Update lenovo software fix to version 7.6.2.10 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| lenovo | software fix | < 7.6.2.10 |
Original advisory text
An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.
An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published10 Sep 2026
Updated4 Nov 2026
First seen10 Sep 2026
Track software like this
Free during beta