# Lenovo vulnerabilities Source: https://junglewise.ai/threats/vendors/lenovo Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/lenovo.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 58 vulnerabilities in Lenovo: 9 in the last 7 days and 20 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-81936, was published on 11 November 2026. 7 vulnerabilities in the last four weeks, up from none in the four before. 17 technologies have a page of their own. ## Counts - Last 7 days: 9 - Last 30 days: 16 - Last 90 days: 20 - All time: 58 (1 critical, 0 exploited in the wild) ## About Lenovo A multinational technology company that designs, manufactures, and markets consumer electronics, personal computers, and business solutions. ## Latest Lenovo vulnerabilities - [CVE-2026-81936: Lenovo XClarity Controller 3 default password re-introduced after reset](https://junglewise.ai/threats/cve-2026-81936-an-internal-security-review-identified-a-development-regression) (medium, CVSS 6.8, published 11 Nov 2026) - [CVE-2026-65952: Lenovo XClarity Essentials OneCLI command injection in SSH operation](https://junglewise.ai/threats/cve-2026-65952-improper-neutralization-of-special-elements-used-in-an-os-command) (high, CVSS 8.5, published 11 Nov 2026) - [CVE-2026-65951: Lenovo XClarity Essentials OneCLI path traversal in TAR.GZ extraction](https://junglewise.ai/threats/cve-2026-65951-a-path-traversal-vulnerability-in-the-tar-gz-extraction-logic-of) (medium, CVSS 5.8, published 11 Nov 2026) - [CVE-2026-65950: Lenovo XClarity Essentials OneCLI path traversal in ZIP extraction](https://junglewise.ai/threats/cve-2026-65950-a-path-traversal-vulnerability-in-the-zip-extraction-logic-of) (medium, CVSS 5.8, published 11 Nov 2026) - [CVE-2026-65949: Lenovo XClarity Integrator for Windows Admin Center command injection](https://junglewise.ai/threats/cve-2026-65949-improper-neutralization-of-special-elements-used-in-an-os-command) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-89061: Lenovo PC Manager privilege escalation](https://junglewise.ai/threats/cve-2026-89061-during-an-internal-security-assessment-a-potential-vulnerability) (high, CVSS 7.8, published 11 Nov 2026) - [CVE-2026-77882: Lenovo System Update deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-77882-a-deserialization-of-untrusted-data-vulnerability-was-discovered) (high, CVSS 7.8, published 11 Nov 2026) - [CVE-2026-77873: Lenovo System Update improper permissions privilege escalation](https://junglewise.ai/threats/cve-2026-77873-an-improper-permissions-vulnerability-was-reported-in-lenovo) (high, CVSS 7.3, published 11 Nov 2026) - [CVE-2026-116633: Lenovo Tablets arbitrary file write vulnerability](https://junglewise.ai/threats/cve-2026-116633-a-potential-vulnerability-was-reported-in-some-lenovo-tablets) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-92777: Lenovo Tablets privilege escalation with physical access](https://junglewise.ai/threats/cve-2026-92777-a-potential-vulnerability-was-reported-in-some-lenovo-tablets) (medium, CVSS 6.4, published 16 Oct 2026) - [CVE-2026-92629: Lenovo Baiying PC Client privilege escalation via improper authorization](https://junglewise.ai/threats/cve-2026-92629-a-potential-improper-authorization-vulnerability-was-reported-in) (high, CVSS 7.3, published 16 Oct 2026) - [CVE-2026-89062: Lenovo Energy Management driver out-of-bounds write](https://junglewise.ai/threats/cve-2026-89062-a-potential-out-of-bounds-write-vulnerability-was-reported-in-the) (medium, CVSS 5.5, published 16 Oct 2026) - [CVE-2026-89057: Lenovo tablets authentication bypass](https://junglewise.ai/threats/cve-2026-89057-a-potential-authentication-bypass-vulnerability-was-reported-in) (medium, CVSS 6.8, published 16 Oct 2026) - [CVE-2026-75941: Lenovo Legion Zone arbitrary code execution](https://junglewise.ai/threats/cve-2026-75941-a-potential-vulnerability-was-reported-in-the-lenovo-legion-zone) (high, CVSS 8, published 16 Oct 2026) - [CVE-2026-16755: Lenovo Smart Camera C33 information disclosure](https://junglewise.ai/threats/cve-2026-16755-a-potential-vulnerability-was-reported-in-lenovo-smart-camera-c33) (medium, CVSS 5.3, published 16 Oct 2026) - [CVE-2026-16754: Lenovo Smart Camera C33 improper certificate validation](https://junglewise.ai/threats/cve-2026-16754-a-potential-improper-certificate-validation-vulnerability-was) (medium, CVSS 4.8, published 16 Oct 2026) - [CVE-2026-75940: Lenovo Health Android Application information disclosure vulnerability](https://junglewise.ai/threats/cve-2026-75940-lenovo-health-android-application-information-disclosure) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-63427: Lenovo Software Fix authentication bypass](https://junglewise.ai/threats/cve-2026-63427-lenovo-software-fix-authentication-bypass) (high, CVSS 7.8, published 10 Sep 2026) - [CVE-2026-19136: Tianxi AI Agent PC Application command injection](https://junglewise.ai/threats/cve-2026-19136-tianxi-ai-agent-pc-application-command-injection) (high, CVSS 7.8, published 10 Sep 2026) - [CVE-2026-11813: Lenovo Filez Client privilege escalation via improper permissions](https://junglewise.ai/threats/cve-2026-11813-lenovo-filez-client-privilege-escalation-via-improper-permissions) (high, CVSS 7.8, published 10 Sep 2026) - [CVE-2026-63426: During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could…](https://junglewise.ai/threats/cve-2026-63426-during-an-internal-security-assessment-a-potential-vulnerability) (high, CVSS 7.1, published 13 Aug 2026) - [CVE-2026-63425: During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock…](https://junglewise.ai/threats/cve-2026-63425-during-an-internal-security-assessment-a-potential-improper) (high, CVSS 7.8, published 13 Aug 2026) - [CVE-2026-63424: During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could…](https://junglewise.ai/threats/cve-2026-63424-during-an-internal-security-assessment-an-improperly-protected) (high, CVSS 7.3, published 13 Aug 2026) - [CVE-2026-16793: Lenovo XClarity Orchestrator command injection vulnerability](https://junglewise.ai/threats/cve-2026-16793-lenovo-xclarity-orchestrator-command-injection-vulnerability) (high, CVSS 8.8, published 4 Aug 2026) - [CVE-2026-16792: Lenovo XClarity Orchestrator improper certificate validation in microservices](https://junglewise.ai/threats/cve-2026-16792-lenovo-xclarity-orchestrator-improper-certificate-validation-in) (medium, CVSS 6.1, published 4 Aug 2026) ## Most severe Lenovo vulnerabilities - [CVE-2026-75940: Lenovo Health Android Application information disclosure vulnerability](https://junglewise.ai/threats/cve-2026-75940-lenovo-health-android-application-information-disclosure) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-16793: Lenovo XClarity Orchestrator command injection vulnerability](https://junglewise.ai/threats/cve-2026-16793-lenovo-xclarity-orchestrator-command-injection-vulnerability) (high, CVSS 8.8, published 4 Aug 2026) - [CVE-2026-6281: Lenovo Personal Cloud Storage OS command injection](https://junglewise.ai/threats/cve-2026-6281-lenovo-personal-cloud-storage-os-command-injection) (high, CVSS 8.8, published 13 May 2026) - [CVE-2026-65952: Lenovo XClarity Essentials OneCLI command injection in SSH operation](https://junglewise.ai/threats/cve-2026-65952-improper-neutralization-of-special-elements-used-in-an-os-command) (high, CVSS 8.5, published 11 Nov 2026) - [CVE-2026-6282: Lenovo Personal Cloud Storage path traversal in file management](https://junglewise.ai/threats/cve-2026-6282-lenovo-personal-cloud-storage-path-traversal-in-file-management) (high, CVSS 8.1, published 13 May 2026) - [CVE-2026-75941: Lenovo Legion Zone arbitrary code execution](https://junglewise.ai/threats/cve-2026-75941-a-potential-vulnerability-was-reported-in-the-lenovo-legion-zone) (high, CVSS 8, published 16 Oct 2026) - [CVE-2026-19136: Tianxi AI Agent PC Application command injection](https://junglewise.ai/threats/cve-2026-19136-tianxi-ai-agent-pc-application-command-injection) (high, CVSS 7.8, published 10 Sep 2026) - [CVE-2026-4145: During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could…](https://junglewise.ai/threats/cve-2026-4145-during-an-internal-security-assessment-a-potential-vulnerability) (high, CVSS 7.8, published 15 Apr 2026) - [CVE-2026-63427: Lenovo Software Fix authentication bypass](https://junglewise.ai/threats/cve-2026-63427-lenovo-software-fix-authentication-bypass) (high, CVSS 7.8, published 10 Sep 2026) - [CVE-2025-8486: A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with…](https://junglewise.ai/threats/cve-2025-8486-a-potential-vulnerability-was-reported-in-pc-manager-that-could) (high, CVSS 7.8, published 15 Oct 2025) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 4 | 1 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 7 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 9 | 0 | 0 | ## Lenovo technologies - [Lenovo IdeaPad Pro 5 16AGP11 BIOS](https://junglewise.ai/threats/technologies/ideapad-pro-5-16agp11-bios): 4 vulnerabilities - [Lenovo IdeaPad Pro 5 16IPH11 BIOS](https://junglewise.ai/threats/technologies/ideapad-pro-5-16iph11-bios): 4 vulnerabilities - [Lenovo Legion 7 16AGP11 BIOS](https://junglewise.ai/threats/technologies/legion-7-16agp11-bios): 4 vulnerabilities - [Lenovo Legion Pro 5 16ADR10 BIOS](https://junglewise.ai/threats/technologies/legion-pro-5-16adr10-bios): 4 vulnerabilities - [Lenovo Legion Pro 5 16AFR10 BIOS](https://junglewise.ai/threats/technologies/legion-pro-5-16afr10-bios): 4 vulnerabilities - [Lenovo Legion Pro 7 16ADR10H BIOS](https://junglewise.ai/threats/technologies/legion-pro-7-16adr10h-bios): 4 vulnerabilities - [Lenovo Legion Pro 7 16AFR10H BIOS](https://junglewise.ai/threats/technologies/legion-pro-7-16afr10h-bios): 4 vulnerabilities - [Lenovo LOQ 15ARP10E BIOS](https://junglewise.ai/threats/technologies/loq-15arp10e-bios): 4 vulnerabilities - [Lenovo Software Fix](https://junglewise.ai/threats/technologies/software-fix): 4 vulnerabilities - [Lenovo V15 G6 ARP BIOS](https://junglewise.ai/threats/technologies/v15-g6-arp-bios): 4 vulnerabilities - [Lenovo XClarity Essentials OneCLI](https://junglewise.ai/threats/technologies/xclarity-essentials-onecli): 4 vulnerabilities - [Lenovo Yoga Book 9 14IAH10 BIOS](https://junglewise.ai/threats/technologies/yoga-book-9-14iah10-bios): 4 vulnerabilities - [Lenovo Yoga Pro 7 15IPH11 BIOS](https://junglewise.ai/threats/technologies/yoga-pro-7-15iph11-bios): 4 vulnerabilities - [Lenovo App Store](https://junglewise.ai/threats/technologies/app-store): 3 vulnerabilities - [Lenovo Dock Manager](https://junglewise.ai/threats/technologies/dock-manager): 3 vulnerabilities - [Lenovo Pcmanager](https://junglewise.ai/threats/technologies/pcmanager): 3 vulnerabilities - [Lenovo Tablets](https://junglewise.ai/threats/technologies/tablets): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Lenovo vulnerabilities", https://junglewise.ai/threats/vendors/lenovo, 13 November 2026.