CVE-2026-10587 Lenovo CVE debrief

Who should care

System administrators and security teams responsible for managing System Management Mode and power management settings should be aware of this vulnerability and take necessary actions to mitigate it. They should review and update System Management Mode configurations, implement compensating controls to monitor and restrict access to power management settings, and verify and apply vendor remediation if available.

Technical summary

The vulnerability has a CVSS score of 6.8 and is classified as MEDIUM severity. It is caused by a potential out-of-bounds write in System Management Mode, which could allow a local privileged attacker to modify power management settings. The vulnerability affects system administrators and security teams responsible for managing System Management Mode and power management settings.

Defensive priority

Medium priority due to potential impact on system security

Recommended defensive actions

• Review and update System Management Mode configurations
• Implement compensating controls to monitor and restrict access to power management settings
• Verify and apply vendor remediation if available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-16T17:16:53.300Z and was last modified on 2026-07-16T18:16:40.217Z. The NVD entry is currently Awaiting Analysis. The vulnerability affects system administrators and security teams responsible for managing System Management Mode and power management settings. The source confidence is limited, and defenders should verify the affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.