CVE-2026-4134

High

Published: 15 April 2026

Published

15 April 2026

Modified

17 April 2026

KEV Added

—

Patch

—

CVSS Score 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0001 2.6th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4134 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Lenovo Software Fix (inferred from references). Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-11 (User-installed Software).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates CVE-2026-4134 by identifying, reporting, and correcting the privilege escalation flaw in Lenovo Software Fix during installation.

AC-6 Least Privilege good match

prevent

Enforces least privilege to prevent local authenticated users from gaining elevated privileges through exploitation of the untrusted search path vulnerability.

CM-11 User-installed Software good match

prevent

Restricts user-installed software and requires verification prior to installation, preventing low-privilege users from triggering the vulnerable Lenovo Software Fix process.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

The CVE is explicitly a local privilege escalation vulnerability in an installer that allows arbitrary code execution with elevated privileges via untrusted search path, directly mapping to Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authenticated user to execute code with elevated privileges.

Deeper analysisAI

CVE-2026-4134 is a privilege escalation vulnerability in Lenovo Software Fix, discovered during an internal security assessment. The issue occurs during the installation process and could enable a local authenticated user to execute arbitrary code with elevated privileges. It carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and is linked to CWE-427 (Untrusted Search Path), published on 2026-04-15.

The vulnerability can be exploited by a local authenticated user with low privileges who has physical or network access to the affected system. Exploitation requires low complexity and user interaction, such as triggering the installation process. Successful exploitation allows the attacker to execute code with elevated privileges, resulting in high impacts to confidentiality, integrity, and availability.

Mitigation details are provided in the Lenovo product security advisory at https://support.lenovo.com/us/en/product_security/LEN-213829.