CVE-2026-1717: 
Lenovo Vantage vulnerability analysis and mitigation

CVE-2026-1717 is an input validation (argument injection) vulnerability in the LenovoProductivitySystemAddin component used in Lenovo Vantage and Lenovo Baiying that allows a local authenticated user to terminate arbitrary processes running with elevated privileges. It affects Lenovo Vantage versions prior to 1.0.0.138 and the corresponding Lenovo Baiying versions. The vulnerability was published on March 11, 2026, with patches made available around March 25, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.8 (Medium) (Lenovo Advisory, Red Hat CVE).

The root cause is classified as CWE-88 (Improper Neutralization of Argument Delimiters in a Command — 'Argument Injection'). The LenovoProductivitySystemAddin, a privileged component within Lenovo Vantage and Lenovo Baiying, fails to properly validate or sanitize input before passing it to a process-management function. A local authenticated user with low privileges can inject crafted arguments that cause the addin to invoke process termination with elevated privileges on an arbitrary target process. No user interaction is required, and the attack complexity is low (Lenovo Advisory, Red Hat CVE).

Successful exploitation allows a low-privileged local user to terminate arbitrary processes that are running with elevated (e.g., SYSTEM-level) privileges, resulting in a denial-of-service condition. Critical system services, security tools, or application processes could be forcibly killed, disrupting normal system operations and availability. There is no direct confidentiality or integrity impact, but crashing security or monitoring processes could facilitate follow-on attacks (Lenovo Advisory).

• Logs: Unexpected process termination events in Windows Event Log (Event ID 4689 — Process Termination) for high-privilege processes (e.g., SYSTEM-owned services) initiated by a low-privilege user account.
• Process: Unusual invocations of LenovoProductivitySystemAddin with non-standard arguments or targeting processes outside its normal operational scope.
• File System: Review of Lenovo Vantage/Baiying addin logs for anomalous argument strings passed to process management functions.

Lenovo has released a patched version of Lenovo Vantage (version 1.0.0.138 and later) that addresses this vulnerability; users should upgrade immediately via the Microsoft Store or Lenovo's support portal. The same fix applies to Lenovo Baiying (versions prior to 1.0.0.138 are vulnerable). As an interim measure, restrict local system access to trusted users only and monitor process termination events for suspicious activity. Patches and further guidance are available from Lenovo's security advisory (Lenovo Advisory, Lenovo CN Advisory).