CVE-2026-1716

High

Published: 11 March 2026

Published

11 March 2026

Modified

25 March 2026

KEV Added

—

Patch

—

CVSS Score 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS Score 0.0002 6.4th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1716 is a high-severity Argument Injection (CWE-88) vulnerability in Lenovo Vantage. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Modify Registry (T1112); ranked at the 6.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Modify Registry (T1112).

Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1112 Modify Registry Defense Impairment

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

attack.mitre.org →

Why these techniques?

Local authenticated low-priv user can delete arbitrary registry keys via elevated component, directly enabling Modify Registry (T1112) for integrity/availability impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to delete arbitrary registry keys with elevated privileges.

Deeper analysisAI

CVE-2026-1716 is an input validation vulnerability in the DeviceSettingsSystemAddin component used by Lenovo Vantage and Lenovo Baiying. Published on 2026-03-11, it allows a local authenticated user to delete arbitrary registry keys with elevated privileges. The issue is rated with a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) and maps to CWE-88 (Improper Neutralization of Argument Delimiters in a Command).

A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation grants the ability to delete arbitrary registry keys using elevated privileges, resulting in high impacts to integrity and availability, though confidentiality is unaffected.

Lenovo has published security advisories detailing the vulnerability, affected products, and mitigation steps. Security practitioners should consult https://support.lenovo.com/us/en/product_security/LEN-213044 and https://iknow.lenovo.com.cn/detail/438815 for patch information and remediation guidance.