CVE-2026-0421
Medium
Description
A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems where Secure Boot is set to User Mode.
SeverityMedium
CVSS6.5
Exploit probability6. percentile0.2%
ProductThinkPad L13 Gen 6 BIOS
PublishedJan 14, 2026
First seenJan 14, 2026
Weakness typeCWE-252CWE-252
How to fix
Update
- Lenovo ThinkPad L13 Gen 6 BIOS1.10 or later
- Lenovo ThinkPad L13 Gen 6 2 in 1 BIOS1.10 or later
- Lenovo ThinkPad L14 Gen 6 BIOS1.06 or later
- Lenovo ThinkPad L16 Gen 2 BIOS1.06 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Lenovo ThinkPad L13 Gen 6 BIOS | v < 1.10 | 1.10 |
| Lenovo ThinkPad L13 Gen 6 2 in 1 BIOS | v < 1.10 | 1.10 |
| Lenovo ThinkPad L14 Gen 6 BIOS | v < 1.06 | 1.06 |
| Lenovo ThinkPad L16 Gen 2 BIOS | v < 1.06 | 1.06 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.