CVE-2026-12036: 
Lenovo Vantage vulnerability analysis and mitigation

CVE-2026-12036 is an improper link following (symlink attack) vulnerability in the VantageCoreAddin component used by Lenovo Vantage and Lenovo Commercial Vantage. It allows a local authenticated user to perform arbitrary file deletion with elevated privileges. All VantageCoreAddin versions prior to 1.1.0.51 are affected. The vulnerability was published on August 13, 2026, with a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Lenovo Advisory).

The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access — 'Link Following'), meaning the VantageCoreAddin does not properly validate or resolve symbolic links before performing file operations (GitHub Advisory). An attacker with local access can create a malicious symbolic link pointing to an arbitrary target file; when the VantageCoreAddin (running with elevated privileges) follows the link and performs a deletion operation, it deletes the attacker-specified target rather than the intended file. Exploitation requires only low-level local privileges and no user interaction, and maps to CAPEC-132 (Symlink Attack) (Feedly). No public proof-of-concept code has been identified at this time.

Successful exploitation allows a local authenticated attacker to delete arbitrary files on the system with elevated (likely SYSTEM-level) privileges, bypassing normal access controls. This can result in deletion of critical operating system files, application binaries, or security tooling, leading to service disruption, system instability, or denial of service. While confidentiality is not directly impacted, the ability to remove security-relevant files could facilitate further privilege escalation or persistence (GitHub Advisory, Lenovo Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of publication (Feedly). CISA's SSVC assessment classifies exploitation as 'none' and the vulnerability as not automatable, though technical impact is rated 'total' (Feedly). The EPSS score is approximately 0.16%, placing it in the 6th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify a target Lenovo system running Lenovo Vantage or Lenovo Commercial Vantage with VantageCoreAddin version prior to 1.1.0.51, using local access or remote management tools.
2. Identify target file path: Determine a file path that the VantageCoreAddin is expected to delete during its normal operation (e.g., a temporary file or log file in a writable directory).
3. Create symbolic link: Using a low-privileged local account, create a symbolic link at the expected file path that points to a high-value target file (e.g., a critical system file or security tool binary) — for example, using mklink on Windows: mklink C:\path\to\expected\file.tmp C:\Windows\System32\targetfile.dll.
4. Trigger the vulnerable operation: Initiate the VantageCoreAddin action that causes it to delete the file at the expected path (e.g., by triggering a cleanup or update routine).
5. Achieve arbitrary file deletion: The VantageCoreAddin, running with elevated privileges, follows the symbolic link and deletes the attacker-specified target file, potentially causing system instability or enabling further attack steps (Feedly, Lenovo Advisory).

• File System: Presence of unexpected symbolic links in directories where VantageCoreAddin performs file operations (e.g., temp or working directories used by Lenovo Vantage); missing or deleted system/application files that should not have been removed.
• Logs: Windows Security Event Log entries showing file deletion events (Event ID 4663) initiated by the VantageCoreAddin process targeting files outside its expected scope; audit logs showing symbolic link creation (Event ID 4663 with object type 'Symbolic Link') by a low-privileged user account.
• Process: VantageCoreAddin.exe performing file deletion operations on paths outside its normal working directories, particularly targeting system-critical locations.

Lenovo has released a patched version of VantageCoreAddin (version 1.1.0.51 or later) to address this vulnerability. Users should update Lenovo Vantage or Lenovo Commercial Vantage through the Microsoft Store or Lenovo's update mechanism to obtain the fixed component. As an interim measure, restrict local access to affected systems to trusted users only and monitor for suspicious file deletion activity (Lenovo Advisory, Feedly).