CVE-2026-12036
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.
Risk Assessment
A local user can delete arbitrary system files with elevated privileges, potentially leading to system corruption or data loss.
Recommendation
Update the VantageCoreAddin and Lenovo Vantage/Commercial Vantage to a version containing the fix. Restrict local user privileges.
Original NVD description (English source)
An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.