CVE-2026-8637: A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to execute arbitrary code with elevated privileges

Synopsis

An uncontrolled search path vulnerability affects the LanSchool Classic client application by Lenovo in versions below 9.3.1.30. The flaw is exploited locally by an authenticated user with low-level privileges, requiring no network access. Successful exploitation allows the attacker to execute arbitrary code with elevated privileges on the host. A patched-image rebuild at version 9.3.1.30 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative credentials to trigger the vulnerability.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker can exploit the flaw entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required.

Blast Radius

• Attacker executes arbitrary code on the host with elevated privileges, gaining control beyond the original low-privilege account.
• Confidential data stored on the host, including files and credentials accessible to higher-privilege processes, becomes readable to the attacker.
• The attacker can modify files, configuration, or persisted data on the host system.
• Local system availability can be disrupted, including termination of processes or corruption of application state.