Lenovo System Update vulnerabilities

16 CVEs affecting Lenovo System Update, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-6387, published 2026-08-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-2219, published 2015-05-12. High severity, CVSS 7.2. EPSS: 4.1% chance of exploitation in the next 30 days. Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to…
CVE-2019-6175, published 2019-09-26. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to be written to non-standard locations.
CVE-2019-6163, published 2019-06-26. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be written to non-standard locations.
CVE-2015-7336, published 2020-03-27. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and…
CVE-2015-6971, published 2017-10-03. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe) and gain privileges by launching signed…
CVE-2015-2233, published 2015-05-12. High severity, CVSS 8.3. EPSS: 0.4% chance of exploitation in the next 30 days. Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and…
CVE-2018-9063, published 2018-05-04. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very large user ID or…
CVE-2015-7334, published 2020-03-27. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System…
CVE-2015-7333, published 2020-03-27. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System…
CVE-2023-4632, published 2023-11-08. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges.

Latest

CVE-2026-6387, published 2026-08-13. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.
CVE-2022-4568, published 2023-05-01. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges.
CVE-2022-0354, published 2022-04-22. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of…
CVE-2020-8342, published 2020-09-15. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege.
CVE-2015-7335, published 2020-03-27. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and…