CVE-2026-0421: Lenovo Thinkpad l13 Gen 6 2 In 1 BIOS

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems where Secure Boot is set to User Mode.

Affected products

• Lenovo Thinkpad l13 Gen 6 2 In 1 BIOS: before 1.10 (fixed in 1.10)
• Lenovo Thinkpad l13 Gen 6 BIOS: before 1.10 (fixed in 1.10)
• Lenovo Thinkpad l14 Gen 6 BIOS: before 1.06 (fixed in 1.06)
• Lenovo Thinkpad l16 Gen 2 BIOS: before 1.06 (fixed in 1.06)

Published 2026-01-14. Last modified 2026-06-17.