CVE-2026-0940
Medium
Description
A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local privileged user to modify data and execute arbitrary code.
SeverityMedium
CVSS6.7
Exploit probability—
ProductThinkPad T14 Gen 5 BIOS
PublishedMar 11, 2026
First seenMar 11, 2026
Weakness typeCWE-665CWE-665
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Lenovo ThinkPad T14 Gen 5 BIOS | v ≤ 1.17 | — |
| Lenovo ThinkPad P14s Gen 5 BIOS | v ≤ 1.17 | — |
| Lenovo ThinkPad Z13 Gen 2 BIOS | v ≤ 1.37 | — |
| Lenovo ThinkPad Z16 Gen 2 BIOS | v ≤ 1.37 | — |
| Lenovo ThinkPad P16v Gen 1 BIOS | v ≤ 1.62 | — |
| Lenovo ThinkPad P15v Gen 3 BIOS | v ≤ 1.28 | — |
| Lenovo ThinkPad Z13 Gen 1 BIOS | v ≤ 1.76 | — |
| Lenovo ThinkPad Z16 Gen 1 BIOS | v ≤ 1.76 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.