{"id":"CVE-2026-0421","state":"PUBLISHED","title":"A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when con","description":"A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems where Secure Boot is set to User Mode.","publishedAt":"2026-01-14T22:18:56.115Z","updatedAt":"2026-02-26T15:04:07.954Z","severity":{"score":7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"lenovo"},"assigner":"lenovo","products":["Lenovo ThinkPad L13 Gen 6 BIOS","Lenovo ThinkPad L13 Gen 6 2 in 1 BIOS","Lenovo ThinkPad L14 Gen 6 BIOS","Lenovo ThinkPad L16 Gen 2 BIOS"],"affected":[{"vendor":"Lenovo","product":"ThinkPad L13 Gen 6 BIOS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.10","versionType":"custom"}]},{"vendor":"Lenovo","product":"ThinkPad L13 Gen 6 2 in 1 BIOS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.10","versionType":"custom"}]},{"vendor":"Lenovo","product":"ThinkPad L14 Gen 6 BIOS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.06","versionType":"custom"}]},{"vendor":"Lenovo","product":"ThinkPad L16 Gen 2 BIOS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.06","versionType":"custom"}]}],"references":["https://support.lenovo.com/us/en/product_security/LEN-210688"],"weaknesses":["CWE-252"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/0xxx/CVE-2026-0421.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-0421","state":"PUBLISHED","datePublished":"2026-01-14T22:18:56.115Z","dateUpdated":"2026-02-26T15:04:07.954Z","assignerShortName":"lenovo","assignerOrgId":"da227ddf-6e25-4b41-b023-0f976dcaca4b","dateReserved":"2025-12-04T19:05:55.282Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems where Secure Boot is set to User Mode."}],"affected":[{"vendor":"Lenovo","product":"ThinkPad L13 Gen 6 BIOS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.10","versionType":"custom"}]},{"vendor":"Lenovo","product":"ThinkPad L13 Gen 6 2 in 1 BIOS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.10","versionType":"custom"}]},{"vendor":"Lenovo","product":"ThinkPad L14 Gen 6 BIOS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.06","versionType":"custom"}]},{"vendor":"Lenovo","product":"ThinkPad L16 Gen 2 BIOS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.06","versionType":"custom"}]}],"references":[{"url":"https://support.lenovo.com/us/en/product_security/LEN-210688"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":7,"baseSeverity":"HIGH","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-252","description":"CWE-252: Unchecked Return Value","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"lenovo","orgId":"da227ddf-6e25-4b41-b023-0f976dcaca4b","dateUpdated":"2026-01-14T22:18:56.115Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:lenovo:thinkpad_l13_gen_6_bios:*:*:*:*:*:*:*:*","versionEndExcluding":"1.10","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:lenovo:thinkpad_l13_gen_6_2_in_1_bios:*:*:*:*:*:*:*:*","versionEndExcluding":"1.10","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:lenovo:thinkpad_l14_gen_6_bios:*:*:*:*:*:*:*:*","versionEndExcluding":"1.06","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:lenovo:thinkpad_l16_gen_2_bios:*:*:*:*:*:*:*:*","versionEndExcluding":"1.06","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">Update to the version (or higher) as recommended in the Product Impact section in the advisory:&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://support.lenovo.com/us/en/product_security/LEN-210688\">https://support.lenovo.com/us/en/product_security/LEN-210688</a></span><br>"}],"value":"Update to the version (or higher) as recommended in the Product Impact section in the advisory:  https://support.lenovo.com/us/en/product_security/LEN-210688"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.3.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-0421","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-01-16T04:55:45.785849Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T15:04:07.954Z"}}]}}}