CVE-2026-0421

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-14 · updated 2026-06-17
Weakness: CWE-252

Description

A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems where Secure Boot is set to User Mode.

Affected products

Lenovo ThinkPad L13 Gen 6 2 in 1 BIOS: before 1.10 — fixed in 1.10
Lenovo ThinkPad L13 Gen 6 BIOS: before 1.10 — fixed in 1.10
Lenovo ThinkPad L14 Gen 6 BIOS: before 1.06 — fixed in 1.06
Lenovo ThinkPad L16 Gen 2 BIOS: before 1.06 — fixed in 1.06

How to fix

Upgrade to a fixed version: Lenovo ThinkPad L13 Gen 6 2 in 1 BIOS 1.10; Lenovo ThinkPad L13 Gen 6 BIOS 1.10; Lenovo ThinkPad L14 Gen 6 BIOS 1.06; Lenovo ThinkPad L16 Gen 2 BIOS 1.06. Check the vendor advisory for mitigations.

References

https://support.lenovo.com/us/en/product_security/LEN-210688

Get alerted when CVE-2026-0421 or the next vulnerability affects your stack