CVE-2026-12036: High severity Lenovo Vantage vulnerability
An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lenovo Vantage/VantageCoreAddin (Lenovo Commercial Vantage)to a version that resolves this vulnerability.Fixed in 1.1.0.51
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12036?
CVE-2026-12036 has a severity rating of 7.1 on the CVSS scale, indicating a high risk.
What does CVE-2026-12036 involve?
CVE-2026-12036 involves an improper link following vulnerability that could allow authenticated users to delete files with elevated privileges.
How do I fix CVE-2026-12036?
To mitigate CVE-2026-12036, users should update the VantageCoreAddin to the latest version provided by Lenovo.
Who is affected by CVE-2026-12036?
CVE-2026-12036 affects local authenticated users of the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage.
What are the potential impacts of CVE-2026-12036?
CVE-2026-12036 could potentially allow an attacker to perform arbitrary file deletion, leading to loss of data or system instability.