Lenovo PC Manager Privilege Escalation (CVE-2026-89061)
A local privilege escalation vulnerability in the Chinese-market variant of Lenovo PC Manager was identified during an internal security assessment.
CVE search metadata
CVE search record: CVE-2026-89061. KEV: no. Product: PC Manager (Chinese market variant). Brief: Lenovo PC Manager Privilege Escalation (CVE-2026-89061). Brief link: https://feed.craftedsignal.io/briefs/2026-11-lenovo-pc-manager-privilege-escalation-cve-2026-89061/
Triage facts
Revision 1- Applicability
- PC Manager (Chinese market variant)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 17:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
Lenovo PC Manager, distributed exclusively in the Chinese market, contains a vulnerability (CVE-2026-89061) that may allow a local, authenticated user to escalate privileges. The vulnerability was discovered during an internal security assessment. As of this report, no public exploit code or in-the-wild exploitation has been documented.
Impact
Successful exploitation allows a local user to escalate privileges on a machine running the affected software. The vulnerability is rated with a CVSS v3.1 base score of 7.8.
Recommendation
Organizations operating in the Chinese market should inventory systems for the Lenovo PC Manager application and prioritize monitoring for unauthorized local privilege escalation attempts. Contact Lenovo support for guidance on security updates and patches for this specific regional software.
Immediate actions
Inventory systems for Lenovo PC Manager installations within the Chinese regional business unit.
Threat Hunt
Monitor for unauthorized local process creation or unusual privilege changes originating from Lenovo PC Manager binary paths.
Data: Endpoint process creation logs, Account usage logs