CVE-2026-9045

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 10, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-904504.3The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role reCVE-2026-904515.9An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled CVE-2026-904525.3Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify tCVE-2026-904533.5A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without CVE-2026-904544.3A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routCVE-2026-904553.7A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing thCVE-2026-904568.1An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative pasCVE-2026-904576.2The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, aCVE-2026-904585.4OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.CVE-2026-90467.0A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusCVE-2026-904607.6An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, applicatCVE-2026-904616.3OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) B
CVE-2026-9045: High severity, CVSS 7.8 | Vulnix