CVE-2026-8637

HighCVSS 7.8/10Last modified Oct 26, 2026

Description

A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to execute arbitrary code with elevated privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LenovoLanSchool Classic< 9.3.1.30

References

Timeline

Published
Jun 10, 2026
Last modified
Oct 26, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-863756.2Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated atCVE-2026-863777.6Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reCVE-2026-863788.8Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reCVE-2026-863797.2Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1CVE-2026-863807.2Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reCVE-2026-863836.8Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 releCVE-2026-863849.8Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reCVE-2026-863858.8Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges vulnerability.CVE-2026-863864.3Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1CVE-2026-863885.3Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reCVE-2026-863897.2Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reCVE-2026-86398.8IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can estab