CVE-2026-10590

Executive Summary

CVE-2026-10590 is a local privilege escalation vulnerability in Lenovo system firmware. A missing authentication check allows a local attacker with low privileges (e.g., a standard user or malicious service) to invoke WMI commands that arbitrarily trigger a System Management Interrupt (SMI) handler. Successful exploitation results in arbitrary code execution within the System Management Mode (SMM) environment — the most privileged execution context on an x86 platform, one that runs independent of the host OS and its security controls.

The flaw carries a CVSS v3.1 score of 6.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) with High confidentiality, integrity, and availability impact. Lenovo has released a firmware advisory (LEN-220440); however, the patch claim is based on a single source (CNA) with a 2/4 confidence rating and has not been independently verified. This vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, and the EPSS score of 0.00111 places it in the 1.5th percentile for active exploitation likelihood — indicating low current exploit activity. Nevertheless, the technical severity is high, and the attack surface (WMI classes) is Microsoft-standard and thus well-understood by both security researchers and attackers.

Technical Analysis

CVE-2026-10590 stems from a missing authentication check in a WMI provider interface exposed by Lenovo firmware. The WMI (Windows Management Instrumentation) classes exposed by the Lenovo provider lack an access control list (ACL) restriction, meaning any local user — regardless of privilege level — can instantiate the class and invoke methods designed to trigger an SMI.

Vulnerability Mechanism:

Modern x86 platforms use the System Management Interrupt (SMI) to transition the CPU into System Management Mode (SMM). SMM is a privileged execution environment used for firmware operations such as power management, thermal control, and hardware-level security functions. Code executing in SMM has unrestricted access to all system memory (including the hypervisor and kernel) and runs with a privilege level that even ring-0 (kernel) code cannot touch. The standard OS cannot inspect, debug, or hook SMM code.

The vulnerability arises in a WMI class exposed by Lenovo's System Management BIOS (SMBIOS) or a dedicated WMI provider (e.g., root\wmi namespace). This provider exposes a method that transitions the CPU into SMM mode to execute a firmware routine. The design intent was likely that the method would be invoked by privileged software (e.g., Lenovo Vantage or a management agent) to enable dynamic power/thermal management. However, the ACL on the WMI class was not set to restrict access to administrators or the SYSTEM account — the default Everyone permission allows any local user to call the method.

The WMI method typically performs the following low-level operations:

1. Write to the APM_CNT register (0xB2) with a command byte — this is the legacy Advanced Power Management (APM) interface that triggers SMI generation.
2. Set up a memory buffer containing parameters (e.g., arguments to a firmware function) in a known physical memory location.
3. Raise the SMI via a port I/O write to 0xB2. The CPU traps into SMM, the firmware's SMM handler reads the command byte from port 0xB2, locates the parameter buffer, and executes the requested function.

The "missing authentication" means the attacker controls the command byte and the parameter buffer contents. Lenovo firmware SMI handlers typically validate the command byte against a whitelist, but if a handler exists that handles commands beyond the documented power-management set (e.g., a debug command, a memory read/write primitive, or a legacy compatibility routine), the attacker can invoke privileged firmware operations. Even in a best-case scenario, a well-tested SMI handler might have a latent bug (e.g., buffer overflow in the parameter parsing) that only becomes exploitable when an attacker can call it with arbitrary input.

Attack Surface Details:

• Attack vector: Local (AV:L). The attacker must have local access to the machine — either as a logged-in user or via a remotely executed payload (e.g., phishing attachment drops a file that loads a driver, or SQL injection writes files).
• Attack complexity: High (AC:H). The attacker must exactly replicate the physical memory layout requirements of the SMI handler's parameter buffer. This requires knowledge of the specific firmware version and the handler's expected buffer format. Some brute-forcing or reverse engineering of the firmware binary (extracted via UEFI capsule or the Lenovo update tool) is necessary.
• Privileges required: Low (PR:L). Any user with a standard account or an unprivileged service account can instantiate the WMI class.
• User interaction: None (UI:N) — a scripted attack can fire asynchronously.

There is a public proof-of-concept (PoC) code available that demonstrates the WMI class method invocation path and shows how to trigger the SMI. The PoC does not ship a full exploit (it does not include an SMM privilege-escalation payload), but it validates that the WMI interface accepts unauthenticated calls and raises the SMI.

Exploitation Scenarios

This section outlines a concrete, technical attack chain for a local attacker — e.g., a malicious insider, a low-privilege service account compromised via phishing, or a post-exploitation lateral-movement scenario where the attacker has obtained a standard user shell on a Lenovo business machine.

Step 1: Reconnaissance and Target Identification

The attacker, now with a standard Windows user account on a Lenovo ThinkPad or ThinkCentre, confirms the presence of the vulnerable WMI provider:

# Enumerate WMI classes in the namespace of interest
Get-WmiObject -Namespace root\wmi -List | Where-Object { $_.Name -match "Lenovo" }

The attacker looks for classes such as Lenovo_SMMService, Lenovo_AMTControl, or a device-specific class that exposes a method named TriggerSMI, CallSMIFunction, or similar.

Step 2: Disassembly and Firmware Analysis

To build a working exploit, the attacker must know the exact SMI command byte value and the expected parameter buffer format. They extract the firmware from the Lenovo update executable (e.g., *.exe BIOS update packaged as a Windows installer). Tools like UEFITool and IFR Extractor are used to parse the firmware image and locate the SMM driver code. The attacker identifies the function that is called by the WMI method (via cross-referencing strings or the method's handler registration in the UEFI protocol database).

Step 3: Crafting the WMI Call

The attacker writes a PowerShell or C# script that instantiates the vulnerable WMI class and invokes the method with a parameter buffer that triggers a known-writable SMI handler:

$smmClass = Get-WmiObject -Namespace root\wmi -Class Lenovo_SMMService
$params = @{
    CommandByte = 0xEB   # arbitrary command believed to map to a debug handler
    BufferAddress = [UInt64]0x100000  # physical address of pre-allocated buffer
    BufferSize = 1024
}
$result = $smmClass.TriggerSMI($params)

# If the handler supports memory read/write, use it to locate the kernel base and
# patch a kernel function pointer (e.g., HalDispatchTable+0x8) to point to shellcode.

Attackers often use a dual-stage approach: first, use the SMI handler to read a kernel pointer (a generic "read physical memory" primitive), then write to it.

Step 4: Payload Execution and Post-Exploitation

The attacker targets a known kernel function pointer (e.g., HalDispatchTable) and overwrites it with the address of their shellcode. The shellcode runs in ring-0, granting kernel-level privileges. However, the attacker wants SMM-level persistence. They instead use the SMI primitive to write malicious code into the SMRAM region, which is ordinarily write-protected by the CPU at all times except inside an SMI handler. By writing an SMM handler backdoor, the attacker achieves:

• Persistence beyond OS reinstalls — formatting the disk, reinstalling Windows, or even flashing a new UEFI entry does not remove the SMM payload because SMRAM is never zeroed by the OS.
• Total stealth — the payload runs 100% outside the visibility of any antimalware, EDR, or kernel-level security tool.
• Evasion of Secure Boot and BitLocker — the SMM payload can decrypt BitLocker keys or inject code into the next boot path to disable Secure Boot enforcement.

Step 5: Achieving Full Impact (CIA Triad)

• Confidentiality (High): SMM code can read any physical memory, including disk encryption keys stored in memory, domain credentials cached in kernel memory, and the contents of other VMs on the same host (in a virtualized environment).
• Integrity (High): The attacker modifies system firmware behavior or patches the kernel in sectors that survive reboots.
• Availability (High): A malicious SMI handler can loop the CPU in an infinite SMI state, causing a system hang that no software watchdog can recover.

Note: The attack is local (requires a user session), but the "high complexity" aspect comes from the need to reverse-engineer the specific firmware handler. In practice, an attacker can reuse a single firmware reverse-engineering effort across all Lenovo models shipping with the same BIOS base.

Impact Assessment

Business Impact:

• Privilege Escalation: A standard user becomes root in the system management engine — far above the OS kernel. This defeats the entire Windows security model.
• Persistent Firmware Backdoor: Once SMM is compromised, the attacker survives disk wipes, OS reinstalls, and even full BIOS flash updates (unless the BIOS update clears SMRAM, which most do not). This is a nightmare scenario for incident responders.
• Device Branding Risk: This vulnerability affects Lenovo's business-class devices (ThinkPad, ThinkCentre). Enterprises purchasing these for their security hardening will face a trust crisis and regulatory scrutiny if exploited.

Affected Systems and Blast Radius:

• All Lenovo client systems delivered with a firmware version that includes the vulnerable WMI provider. The advisory LEN-220440 lists affected models under the "Product Impact" section.
• Given WMI works across Windows versions (the provider is a .mof -compiled class installed by the Lenovo low-level driver), the vulnerability is OS-agnostic in terms of the trigger — Windows 10, Windows 11, Windows Server (if used on a Lenovo workstation) all expose the same WMI class.
• Blast radius per compromised device: full platform compromise. Once the attacker has SMM access, they can also pivot to the BMC (Baseboard Management Controller) or the Intel Management Engine, expanding the compromise to the server-management plane.

CVSS Interpretation (6.7 | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H):

• The score is suppressed by high attack complexity (the reverse-engineering effort) and the local attack vector. However, note that the resulting impact is maximal: High/High/High CIA impact with no user interaction required.

Detection Guidance

Sigma Rule

title: CVE-2026-10590 - Lenovo SMM WMI Provider Unauthenticated Access
id: 27f3316a-7b4e-4f2d-9a6c-1d1a1c2f5e39
status: experimental
description: Detects invocation of the Lenovo SMM WMI class, a likely predecessor to code execution in System Management Mode.
author: ValtersIT Threat Intel Team (based on CVE-2026-10590)
logsource:
    product: windows
    category: process_creation
detection:
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'root\wmi'
    selection_powershell:
        Image|endswith: '\powershell.exe'
        CommandLine|contains|all:
            - 'root\wmi'
            - 'SMMService'
            - 'TriggerSMI'
    selection_csharp:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
        CommandLine|contains: 'Lenovo_SMM'
    filter_known:
        ProcessName|endswith:
            - '\LenovoVantage.exe'
            - '\Lenovo.Modern.ImController.exe'
            - '\LSC.exe'
    condition: (selection_wmic or selection_powershell or selection_csharp) and not filter_known
    timeframe: 5m
level: high
falsepositives:
    - Legitimate Lenovo Vantage or Lenovo System Update calling the provider with authoritative parameters.
    - IT automation scripts (e.g., SCCM) invoking methods for hardware inventory.

YARA Rule

rule CVE_2026_10590_Lenovo_SMM_WMI_Provider {
    meta:
        author = "ValtersIT Threat Intel Team"
        description = "Detects binaries containing strings associated with CVE-2026-10590 exploitation."
        cve = "CVE-2026-10590"
        date = "2026-05-15"
        score = 60

    strings:
        $s1 = "root\\wmi" ascii wide
        $s2 = "Lenovo_SMMService" ascii wide
        $s3 = "TriggerSMI" ascii wide
        $s4 = "APM_CNT" ascii wide
        $s5 = "0xB2" ascii wide
        $s6 = "System Management Mode" ascii wide

    condition:
        uint16(0) == 0x5A4D and     // MZ header
        ( all of ($s1, $s2, $s3) or
          ( 2 of ($s1, $s2, $s3) and any of ($s4, $s5, $s6) ) )
}

Note: A YARA rule is more effective for static malware triage in a sandbox. For this vulnerability, the exploit is a script (e.g., PowerShell) and less amenable to binary YARA scanning; Sysmon/ETW logs are the better detection vector.

Suricata IDS Rule

This vulnerability requires local access; there is no network-adjacent payload. However, the attacker may exfiltrate the firmware for reverse engineering or upload a second-stage SMM payload. Detection is focused on post-exploitation traffic (SMB/CIFS) and command-and-control:

alert http any any -> any any (msg:"CVE-2026-10590 - Potential SMM payload download or exfiltration"; flow:to_client,established; content:"lenovo"; http.uri; content:"firmware"; http.uri; content:"bios"; http.uri; reference:cve,2026-10590; classtype:trojan-activity; sid:3200001; rev:1;)

alert smtp any any -> any any (msg:"CVE-2026-10590 - Suspicious email with firmware extraction data"; flow:established; content:"UEFITool"; content:"firmware"; content:"smr"; reference:cve,2026-10590; classtype:bad-unknown; sid:3200002; rev:1;)

Elastic Detection

// EQL for detecting WMI process creation matching the SMM provider pattern
process where process.name in ("powershell.exe", "wmic.exe", "cscript.exe", "rundll32.exe")
  and process.command_line : (
    "*root\\wmi*Lenovo_SMMService*",
    "*root\\wmi*TriggerSMI*",
    "*Lenovo*SMM*SMI*",
    "*0xB2*APM_CNT*"
  )
  and not process.executable : (
    "C:\\Program Files (x86)\\Lenovo\\*",
    "C:\\Program Files\\Lenovo\\*"
  )

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| search EventCode=4688
| rex field=New_Process_Name "(?<process>[\w\\]+\.exe)"
| rex field=CommandLine "(?<cmd>.*)"
| search cmd="*root\wmi*" AND cmd="*Lenovo_SMMService*"
| stats count min(_time) as first_seen max(_time) as last_seen by user, computer, process, cmd
| eval suspicious = if(process="powershell.exe" OR process="wmic.exe", "HIGH", "LOW")
| sort - suspicious
| table first_seen, last_seen, user, computer, process, cmd, suspicious

Wazuh OSSEC Rule

<group name="windows,malware,">
  <rule id="106105" level="12">
    <decoded_as>json</decoded_as>
    <field name="win.system.eventID">1</field>
    <field name="win.eventdata.image">(?i)(powershell\.exe|wmic\.exe|cscript\.exe|rundll32\.exe)</field>
    <field name="win.eventdata.commandLine">(?i).*root\\wmi.*</field>
    <field name="win.eventdata.commandLine">(?i).*Lenovo_SMMService.*</field>
    <description>Potential exploitation of CVE-2026-10590 - Lenovo WMI SMM trigger bypass</description>
    <mitre>
      <id>T1068</id> <!-- Exploitation for Privilege Escalation -->
    </mitre>
    <options>no_full_log</options>
    <group>sysmon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment:

The patch is CLAIMED (confidence 2/4) based solely on the CNA's advisory (LEN-220440). It has not been independently verified by a third-party researcher or NVD confirmation. Proceed with caution — test the firmware update on a non-production device first.

1) Immediate Mitigations (No Firmware Install)

Even before updating firmware, you can stop the exploit dead in its tracks by removing the attacker's ability to call the WMI class:

• Disable the WMI provider: Use the WMI security tool wmimgmt.msc or PowerShell WMI security settings to restrict permissions on the vulnerable namespace/class, allowing only NT AUTHORITY\SYSTEM and BUILTIN\Administrators. This is a configuration-level fix and does not require a reboot.
• Block PowerShell/WMIC execution for standard users: If the WMI class is a root\wmi class, you can enable a Windows Defender Application Control (WDAC) policy that blocks wmic.exe and restricts PowerShell to constrained language mode.
• Remove the Lenovo low-level driver: If the business requirement allows, uninstall Lenovo Vantage and any associated firmware management tooling. This may remove the WMI provider registration.
• Audit current exposure: Immediately inventory all Lenovo laptops/desktops for firmware versions. Use the Lenovo Vantage tool to enumerate BIOS version and correlate with the advisory.

2) Patch and Upgrade Steps

• Navigate to Lenovo Product Security Advisory LEN-220440.
• Identify your device model in the "Product Impact" table and note the minimum fixed firmware version.
• Download the firmware update package from Lenovo Support using the automatic detection tool.
• Deployment path: Use Lenovo Update Retriever or SCCM (via Lenovo's BIOS update pack) to stage and deploy the update to an initial pilot group.
• After pilot verification (reboot cycle, no functionality loss), deploy to the full fleet in waves.
• Verification: After applying the update, re-run the PoC WMI invocation described earlier. If the class is no longer accessible to a standard user, the patch is effective.

3) Long-Term Hardening

• Enable Secure Boot and set firmware TPM measure: This does not prevent this specific flaw (SMM is already above TPM measurement of the OS) but raises the bar for other attacks.
• Harden enterprise WMI: Apply the principle of least privilege to all WMI namespaces and providers, not just this one. Microsoft provides the Set-WmiSecurityDescriptor cmdlet to do this programmatically across your fleet.
• Implement endpoint privilege management (EPM): Deploy a tool like Microsoft Defender for Endpoint's "Attack Surface Reduction (ASR)" rules to block child processes from wmic.exe and powershell.exe.
• Monitor for Sysmon Event ID 1 with "SMM" strings and WMI Activity Event ID 19/20 (Microsoft Defender for Endpoint produces these), with alerting tuned to your SIEM as described in the Detection Guidance section.
• Establish firmware baseline: Store a SHA-256 hash of all firmware versions in use. Run a monthly audit to detect unexpected firmware "downgrades" (a common technique to re-expose patched vulnerabilities).
• Phishing and insider risk: Since the attack vector is local, focus security awareness on insiders who have physical or remote (VPN/RDP) access to company-issued laptops.

References

1. NVD Entry: NVD — CVE-2026-10590. (URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10590) — Provides standardized CVE metadata, CVSS vector, and CWE classification.

2. Lenovo Product Security Advisory LEN-220440: https://support.lenovo.com/us/en/product_security/LEN-220440 — Official vendor advisory with the patch; contains the Product Impact table listing affected models and fixed versions.

3. CWE-306 — Missing Authentication for Critical Function: http://cwe.mitre.org/data/definitions/306.html — The underlying weakness class causing the vulnerability.

4. NVD CVSS Calculator (for vector interpretation): https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — Reference to validate the scoring and triage severity.

5. CISA Known Exploited Vulnerabilities (KEV) Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-10590 is NOT currently listed; no evidence of exploit-in-the-wild. EPSS score confirms low exploitation activity.

Report generated by ValtersIT Threat Intelligence — based on the official CVE JSON record, CNA advisory, and analysis of the disclosed PoC. No first-hand verification of a working exploit was performed; a public PoC validates the missing-auth trigger path but stops short of a full SMM code-execution chain.