CVE-2026-12036
Received Received - Intake

Improper Link Following in Lenovo VantageCoreAddin

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Lenovo Group Ltd.

Description
An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-12036
EUVD
EUVD-2026-58056

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
lenovo vantagecoreaddin *
lenovo lenovo_commercial_vantage *
lenovo lenovo_vantage *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper link following issue in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage. It allows a local authenticated user to delete arbitrary files with elevated privileges.

Impact Analysis

An attacker with local access could exploit this to delete critical system files, potentially causing system instability or denial of service. It may also lead to unauthorized data access or modification if combined with other vulnerabilities.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized file deletion or data tampering, which may violate integrity requirements in GDPR or HIPAA. Organizations must ensure proper access controls and patching to maintain compliance.

Mitigation Strategies

Update Lenovo Vantage and Lenovo Commercial Vantage to the latest version to address the improper link following vulnerability. Remove or disable the VantageCoreAddin if not required. Ensure least privilege principles are applied to user accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart