01 Record

CVE-2026-12036

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file

MediumPUBLISHEDCNA: lenovo

Base score6.9 CVSS v4.0CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

View raw JSON CVE Program record

02 Description

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file

03 Metadata

Published: 2026-08-13 14:52Z1 DAY AGO
Last updated: 2026-08-13 16:05Z1 DAY AGO
Reserved: 2026-06-11
Assigning CNA: lenovo
Record state: PUBLISHED
Severity: Medium (CVSS 6.9)
CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses: CWE-59
SSVC decision: ExploitationnoneAutomatablenoTechnical Impacttotal
Data version: 5.2
Document digest: 522d2cba910443567abf30b6dee7e96b91334ea025a62e2b1affdb052165fbe4

04 Affected products

VendorProductVersionsPlatforms

LenovoVantage0 to < 1.1.0.51—

05 References

support.lenovo.comhttps://support.lenovo.com/us/en/product_security/LEN-223723vendor-advisory

06 Remediation

Update VantageCoreAddin to version 1.1.0.51 or later. VantageCoreAddin is updated automatically.