CVE-2026-89057: Lenovo Idea Tab/ Lenovo Tab k11 Gen 2 TB336FU
Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days.
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.
Affected products
- Lenovo Idea Tab/ Lenovo Tab k11 Gen 2 TB336FU: before 17.5.10.348 (fixed in 17.5.10.348)
- Lenovo Idea Tab/ Lenovo Tab k11 Gen 2 TB336FU/TB336ZU
- Lenovo Idea Tab/ Lenovo Tab k11 Gen 2 TB336ZU: before 17.5.10.354 (fixed in 17.5.10.354)
- Lenovo Idea Tab Pro TB373FU: before 17.5.10.107 (fixed in 17.5.10.107)
- Lenovo Legion Tab 8.8, 3 TB321FU: before 17.5.10.319 (fixed in 17.5.10.319)
- Lenovo Tab Extreme TB570FU: before 17.5.589 (fixed in 17.5.589)
- Lenovo Tab Extreme TB570ZU: before 17.5.589 (fixed in 17.5.589)
- Lenovo Tab Extreme TB570ZU/TB570FU: before 17.5.589 (fixed in 17.5.589)
- Lenovo Tab k11 Plus Lte Row TB352XU: before 17.0.10.336 (fixed in 17.0.10.336)
- Lenovo Tab k11 Plus TB352FU: before 17.0.10.344 (fixed in 17.0.10.344)
- Lenovo Tab k11 Plus TB352XU: before 17.0.10.336 (fixed in 17.0.10.336)
- Lenovo Tab k11 Plus Wifi Row: TB352FU: before 17.0.10.344 (fixed in 17.0.10.344)
- Lenovo Tab k11 TB330FUP: before 17.0.135 (fixed in 17.0.135)
- Lenovo Tab k11 TB330XUP: before 17.0.157 (fixed in 17.0.157)
- Lenovo Tab k9 TB305FU: before 17.0.10.324 (fixed in 17.0.10.324)
- Lenovo Tab k9 TB305XU: before 17.0.10.318 (fixed in 17.0.10.318)
- Lenovo Tab m10 5g TB360ZU: before 16.0.939 (fixed in 16.0.939)
- Lenovo Tab m11 TB330FU: before 17.0.135 (fixed in 17.0.135)
- Lenovo Tab m11 TB330FU/TB330XU: before 17.0.517 (fixed in 17.0.517)
- Lenovo Tab m11 TB330XU: before 17.0.517 (fixed in 17.0.517)
- Lenovo Tab One TB305FU: before 17.0.10.324 (fixed in 17.0.10.324)
- Lenovo Tab One TB305XU: before 17.0.10.254 (fixed in 17.0.10.254)
- Lenovo Tab p12 TB370FU: before 17.0.352 (fixed in 17.0.352)
- Lenovo Tab p12 TB370FU/TB372FU
- Lenovo Tab p12 TB372FU: before 17.0.223 (fixed in 17.0.223)
- and 6 more
Published 2026-10-16. Last modified 2026-10-16.