{"id":"CVE-2026-89061","kind":"vulnerability","aliases":["CVE-2026-89061"],"related":[],"title":"Lenovo PC Manager: local users can escalate privileges on Windows","description":"During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager, distributed exclusively in the Chinese market, that could allow a local user to escalate privileges.","summary":"Lenovo PC Manager, a utility sold only in the Chinese market, has a flaw found in an internal assessment. A local user could use it to gain higher privileges on the machine.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lenovo","pc-manager","vendor","windows"],"not_affected_if":["not-chinese-market-distribution"],"how_to_check":"Check whether Lenovo PC Manager (联想电脑管家) is installed on Windows and note its version (in the app's About page). Lenovo has not yet published affected versions for this CVE; watch Lenovo PSIRT and iknow.lenovo.com.cn for the bulletin.","fix":null,"status":"open","published_at":"2026-11-11T17:17:23+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","triaged_at":"2026-11-11T17:28:39+00:00","updated_at":"2026-11-11T17:30:21+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-11T17:28:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Lenovo PC Manager: local users can escalate privileges on Windows","impact":"high","summary":"Lenovo PC Manager, a utility sold only in the Chinese market, has a flaw found in an internal assessment. A local user could use it to gain higher privileges on the machine.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["lenovo","windows","pc-manager"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher privileges on the machine","analyst_note":"Find Lenovo's security bulletin for this CVE to get affected versions and the fixed version.","how_to_check":"- Check whether Lenovo PC Manager is installed on the machine and which version it is.\n- unknown for the exact affected versions: the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-chinese-market-distribution"],"who_is_affected":"Machines running Lenovo PC Manager distributed in the Chinese market, where a local user could escalate privileges. The sources do not name affected versions or a fix, so the exact scope is unknown. Teams outside that distribution are likely not exposed, but the sources do not confirm it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":4515,"output_tokens":479,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Lenovo's security bulletin for this CVE to get affected versions and the fixed version.","search":"'-2026':12A,15A '-89061':13A,16A 'allow':77C 'assess':41B,59C 'chines':32B,73C 'could':45B,76C 'cve':11A,14A 'discov':64C 'distribut':69C 'escal':7A,82C 'exclus':70C 'flaw':36B 'found':37B 'gain':49B 'higher':50B 'intern':40B,57C 'lenovo':1A,17B,23B,66C 'local':4A,43B,79C 'machin':54B 'manag':3A,20B,25B,68C 'market':33B,74C 'pc':2A,19B,24B,67C 'pc-manag':18B 'potenti':61C 'privileg':8A,51B,83C 'secur':58C 'sold':28B 'use':46B 'user':5A,44B,80C 'util':27B 'vendor':21B 'vulner':62C 'window':10A,22B","nicknames":[],"mitigations":[],"who_affected":"Windows machines running Lenovo PC Manager (联想电脑管家), which Lenovo says is distributed only in the Chinese market. A local user with an account on the machine could escalate privileges. Lenovo's bulletin with affected versions is not yet published, so the exact range is unknown. Machines without PC Manager can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","lenovo","pcmanager","vendor","windows"],"campaign_type":null,"search_a":"'-2026':12A,15A '-89061':13A,16A 'cve':11A,14A 'escal':7A 'lenovo':1A 'local':4A 'manag':3A 'pc':2A 'privileg':8A 'user':5A 'window':10A","search_b":"'assess':41B 'chines':32B 'could':45B 'flaw':36B 'found':37B 'gain':49B 'higher':50B 'intern':40B 'lenovo':17B,23B 'local':43B 'machin':54B 'manag':20B,25B 'market':33B 'pc':19B,24B 'pc-manag':18B 'privileg':51B 'sold':28B 'use':46B 'user':44B 'util':27B 'vendor':21B 'window':22B","search_c":"'allow':77C 'assess':59C 'chines':73C 'could':76C 'discov':64C 'distribut':69C 'escal':82C 'exclus':70C 'intern':57C 'lenovo':66C 'local':79C 'manag':68C 'market':74C 'pc':67C 'potenti':61C 'privileg':83C 'secur':58C 'user':80C 'vulner':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@lenovo.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89061","severity":null,"published_at":"2026-11-11T17:17:23+00:00","modified_at":"2026-11-11T17:17:23+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","fetched_at":"2026-11-11T17:28:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-89061:3570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89061","severity":null,"published_at":"2026-11-11T17:30:21+00:00","modified_at":"2026-11-11T17:30:21+00:00","first_seen_at":"2026-11-11T17:30:21+00:00","fetched_at":"2026-11-11T17:30:21+00:00","note":"Published minutes ago; Lenovo bulletin (iknow.lenovo.com.cn / PSIRT) not yet found. Only NVD/CNA text exists: no affected range, no fixed version. Prior PC Manager advisories fixed in 5.1.x builds but that is not this CVE. Latest release per guanjia.lenovo.com.cn is 5.1.210.10222 (2026-10-22), not stated as a fix. Revisit when LEN bulletin appears.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-89061"]}],"documents":[{"id":127439,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89061","title":"NVD: CVE-2026-89061","kind":"other","source":"analyst","publisher":null,"text":"During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager, distributed exclusively in the Chinese market, that could allow a local user to escalate privileges. CNA: Lenovo (psirt@lenovo.com). CVSS 4.0 vector AV:L/AC:L/PR:L, 8.5; published 2026-11-11.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}