CVE-2026-6281

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-13 · updated 2026-10-26
Weakness: CWE-78

Description

A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.

Affected products

Lenovo Home Storage Hub T20: before 5.5.8.t20.1 — fixed in 5.5.8.t20.1
Lenovo Home Storage Hub X20: before 5.4.4.x20.1 — fixed in 5.4.4.x20.1
Lenovo Personal Cloud A1: through 5.4.2.a1.3
Lenovo Personal Cloud A1s: through 5.5.6.a1s
Lenovo Personal Cloud T1: through 5.4.0.t1.6
Lenovo Personal Cloud T2: through 5.4.5.t2.2
Lenovo Personal Cloud T2Pro: before 5.4.8.t2pro.2 — fixed in 5.4.8.t2pro.2
Lenovo Personal Cloud T2s: before 5.5.6.t2s.3 — fixed in 5.5.6.t2s.3
Lenovo Personal Cloud X1: through 5.4.7.x1.1
Lenovo Personal Cloud X1s: before 5.4.8.x1s.2 — fixed in 5.4.8.x1s.2

How to fix

Upgrade to a fixed version: Lenovo Home Storage Hub T20 5.5.8.t20.1; Lenovo Home Storage Hub X20 5.4.4.x20.1; Lenovo Personal Cloud T2Pro 5.4.8.t2pro.2; Lenovo Personal Cloud T2s 5.5.6.t2s.3; Lenovo Personal Cloud X1s 5.4.8.x1s.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-6281 or the next vulnerability affects your stack