---
id: "CVE-2026-77873"
page: "https://infrastack.ai/live/CVE-2026-77873"
kind: "vulnerability"
aliases: ["CVE-2026-77873"]
title: "Lenovo System Update: local users can run code with elevated privileges"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "System Update", "fixed": [], "affected": "<= 5.08.03.59", "ecosystem": "vendor"}]
ecosystems: []
tags: ["endpoints", "lenovo", "local-privilege-escalation", "other", "system-update", "windows"]
not_affected_if: ["no-local-untrusted-users", "no-system-update"]
published_at: "2026-11-11T17:17:19+00:00"
first_seen_at: "2026-11-11T17:28:22+00:00"
updated_at: "2026-11-11T17:30:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77873", "first_seen_at": "2026-11-11T17:28:22+00:00"}, {"source": "analyst", "url": "https://cve.imfht.com/detail/CVE-2026-77873", "first_seen_at": "2026-11-11T17:30:03+00:00", "cites": ["https://cve.imfht.com/detail/CVE-2026-77873", "https://support.lenovo.com/gb/da/solutions/ht037099"]}]
exploit_sources: []
---

# Lenovo System Update: local users can run code with elevated privileges

Link for people: https://infrastack.ai/live/CVE-2026-77873 (this .md is for agents)

Lenovo System Update has an improper permissions flaw that lets a local, logged-in user run code with higher privileges. An attacker with a standard account on a Lenovo machine could gain administrator or system-level control.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:System Update affected <= 5.08.03.59 fixed no fixed version listed

## How to check

Open Lenovo System Update > About, or check the installed version in Windows Apps. Per the CVE record (as mirrored), versions up to and including 5.08.03.59 are listed as affected. The fixed version is not confirmed.

## Fix

unknown: Lenovo's advisory for this CVE was not located. Update System Update to the latest version from Lenovo's page (support.lenovo.com/solutions/ht037099) and confirm against the Lenovo advisory.

## Timeline

- 2026-11-11T17:28:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77873
- 2026-11-11T17:30:03+00:00 analyst https://cve.imfht.com/detail/CVE-2026-77873 — Lenovo PSIRT advisory not found (web-cli search; NVD page unreadable). Affected range 0 to 5.08.03.59 from CVE List V5 via mirror only; fix version unknown. Nothing verified. No exploitation or PoC seen. X not searched.

## Documents

- [describes] CVE-2026-77873 (mirror of CVE List V5 record) https://cve.imfht.com/detail/CVE-2026-77873
- [mentions] Lenovo System Update download page https://support.lenovo.com/gb/da/solutions/ht037099

## From the sources

An improper permissions vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_