Authentication Bypass in Lenovo System Update

Lenovo has identified a security vulnerability, CVE-2026-6387, within the Lenovo System Update software, which is widely deployed across Lenovo workstations and laptops. This flaw is categorized as CWE-290 (Authentication Bypass by Spoofing) and exists due to improper authentication handling within the application. A local authenticated user can exploit this vulnerability to bypass existing security controls, facilitating privilege escalation to execute arbitrary code with elevated permissions on the host system. This vulnerability affects all versions of Lenovo System Update prior to 5.08.04.85 on the Windows platform. Given that Lenovo System Update typically runs with system-level privileges to perform driver and firmware maintenance, successful exploitation grants an attacker full control over the affected endpoint.

Impact

Successful exploitation allows a local user, who may have restricted or low-level access, to achieve arbitrary code execution at elevated privilege levels. This poses a significant risk to organizational endpoints by potentially enabling attackers to persist, disable security software, or exfiltrate sensitive data from the local machine. All organizations utilizing Lenovo hardware with affected versions of System Update are at risk of local privilege escalation.

Recommendation

• Identify all workstations and servers within the environment currently running Lenovo System Update versions older than 5.08.04.85.
• Prioritize the deployment of the update to version 5.08.04.85 or later across the fleet via Lenovo's official update channels or enterprise management tools.
• Monitor local process creation logs for unexpected or unauthorized child processes spawned by 'SUService.exe' or other Lenovo System Update associated binaries, which may indicate attempted exploitation.
• Validate that the remediation (version 5.08.04.85) is applied to all systems identified in the vulnerability scan.