CVE-2026-89057

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-16 · updated 2026-10-16
Weakness: CWE-288

Description

A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.

Affected products

Lenovo Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU): before 17.5.10.348 — fixed in 17.5.10.348
Lenovo Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU): before TB336FU：17.5.10.348 ,TB336ZU：17.5.10.354 — fixed in TB336FU：17.5.10.348 , TB336ZU：17.5.10.354
Lenovo Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU): before 17.5.10.354 — fixed in 17.5.10.354
Lenovo Idea Tab Pro (TB373FU): before 17.5.10.107 — fixed in 17.5.10.107
Lenovo Legion Tab (8.8", 3) (TB321FU): before 17.5.10.319 — fixed in 17.5.10.319
Lenovo Tab Extreme (TB570FU): before 17.5.589 — fixed in 17.5.589
Lenovo Tab Extreme (TB570ZU): before 17.5.589 — fixed in 17.5.589
Lenovo Tab Extreme (TB570ZU/TB570FU): before 17.5.589 — fixed in 17.5.589
Lenovo Tab K11 Plus LTE ROW (TB352XU): before 17.0.10.336 — fixed in 17.0.10.336
Lenovo Tab K11 Plus (TB352FU): before 17.0.10.344 — fixed in 17.0.10.344
Lenovo Tab K11 Plus (TB352XU): before 17.0.10.336 — fixed in 17.0.10.336
Lenovo Tab K11 Plus WIFI ROW: TB352FU: before 17.0.10.344 — fixed in 17.0.10.344
Lenovo Tab K11 (TB330FUP): before 17.0.135 — fixed in 17.0.135
Lenovo Tab K11 (TB330XUP): before 17.0.157 — fixed in 17.0.157
Lenovo Tab K9 (TB305FU): before 17.0.10.324 — fixed in 17.0.10.324
Lenovo Tab K9 (TB305XU): before 17.0.10.318 — fixed in 17.0.10.318
Lenovo Tab M10 5G (TB360ZU): before 16.0.939 — fixed in 16.0.939
Lenovo Tab M11 (TB330FU): before 17.0.135 — fixed in 17.0.135
Lenovo Tab M11 (TB330FU/TB330XU): before 17.0.517 — fixed in 17.0.517
Lenovo Tab M11 (TB330XU): before 17.0.517 — fixed in 17.0.517
Lenovo Tab One (TB305FU): before 17.0.10.324 — fixed in 17.0.10.324
Lenovo Tab One (TB305XU): before 17.0.10.254 — fixed in 17.0.10.254
Lenovo Tab P12 (TB370FU): before 17.0.352 — fixed in 17.0.352
Lenovo Tab P12 (TB370FU/TB372FU): before TB370FU：17.0.352, TB372FC：17.0.223 — fixed in TB372FC：17.0.223, TB370FU：17.0.352
Lenovo Tab P12 (TB372FU): before 17.0.223 — fixed in 17.0.223
Lenovo Tab Plus (TB351FU): before 17.5.10.199 — fixed in 17.5.10.199
Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU): before 17.5.36.417 — fixed in 17.5.36.417
Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU): before TB311FU：17.5.36.417 ,TB311XU：17.5.37.350 — fixed in TB311FU：17.5.36.417 , TB311XU：17.5.37.350
Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU): before 17.5.37.350 — fixed in 17.5.37.350
Lenovo Yoga Tab Plus (TB520FU): before 17.5.10.362 — fixed in 17.5.10.362

How to fix

Upgrade to a fixed version: Lenovo Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) 17.5.10.348; Lenovo Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU) TB336FU：17.5.10.348 , TB336ZU：17.5.10.354; Lenovo Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU) 17.5.10.354; Lenovo Idea Tab Pro (TB373FU) 17.5.10.107; Lenovo Legion Tab (8.8", 3) (TB321FU) 17.5.10.319; Lenovo Tab Extreme (TB570FU) 17.5.589; Lenovo Tab Extreme (TB570ZU) 17.5.589; Lenovo Tab Extreme (TB570ZU/TB570FU) 17.5.589; Lenovo Tab K11 Plus LTE ROW (TB352XU) 17.0.10.336; Lenovo Tab K11 Plus (TB352FU) 17.0.10.344; Lenovo Tab K11 Plus (TB352XU) 17.0.10.336; Lenovo Tab K11 Plus WIFI ROW: TB352FU 17.0.10.344. Check the vendor advisory for mitigations.

References

https://support.lenovo.com/us/en/product_security/LEN-218699

Get alerted when CVE-2026-89057 or the next vulnerability affects your stack