CVE-2026-63427
An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.5
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-290
- Published
- 2026-09-10
- Last modified
- 2026-09-10
Affected products
- Lenovo Software Fix
Weakness type
Related vulnerabilities
- CVE-2026-88011 — Traefik: ForwardAuth identity spoofing via dot-form header alias
- CVE-2026-66674 — WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability
- CVE-2026-88879 — Traefik before v2.11.56 Identity Spoofing via Header Alias
- CVE-2026-82563 — Softish C6 Ear Camera and EarVision Android Application Authentication bypass by spoofing
- CVE-2026-82530 — IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header
- CVE-2026-62759 — Windows Netlogon Spoofing Vulnerability
- CVE-2026-86478 — In JetBrains YouTrack before 2025.3.161254,...
- CVE-2026-84186 — Incorrect access control in PrestaShop