Lenovo Vantage vulnerabilities

14 CVEs affecting Lenovo Vantage, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-15994, published 2026-08-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-8327, published 2020-04-14. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bundled in Lenovo Vantage prior to version 10.2003.10.0 that could allow an…
CVE-2020-8316, published 2020-04-14. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to read files on the system with elevated privileges.
CVE-2025-6232, published 2025-07-17. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying specific registry…
CVE-2025-6231, published 2025-07-17. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying an application…
CVE-2023-6044, published 2024-01-19. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Service and execute arbitrary code with…
CVE-2024-12673, published 2025-02-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allow a local attacker to elevate privileges on the…
CVE-2023-6043, published 2024-01-19. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute arbitrary code with elevated privileges.
CVE-2025-6230, published 2025-07-17. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite commands.
CVE-2026-12036, published 2026-08-13. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file…
CVE-2026-15994, published 2026-08-13. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute…

Latest

CVE-2026-1717, published 2026-03-11. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary…
CVE-2026-1716, published 2026-03-11. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to delete arbitrary registry keys…
CVE-2026-1715, published 2026-03-11. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to modify arbitrary registry keys…
CVE-2025-13154, published 2026-01-14. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated…