How severe is CVE-2026-0421?

CVE-2026-0421 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-0421 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-0421?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-0421 have an EU (EUVD) identifier?

Yes. CVE-2026-0421 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2664.

When was CVE-2026-0421 published?

CVE-2026-0421 was published on 2026-01-14 and last updated on 2026-06-17.

CVE-2026-0421

CVE-2026-0421 is a medium-severity vulnerability with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-252.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v4: 7.0
EPSS exploit prediction: 0% (2nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-2664
Weakness: CWE-252
Published: 2026-01-14
Last modified: 2026-06-17

Description

A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems where Secure Boot is set to User Mode.

Frequently asked questions

What is CVE-2026-0421?: A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems where Secure Boot is set to User Mode.
How severe is CVE-2026-0421?: CVE-2026-0421 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-0421 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-0421?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-0421 have an EU (EUVD) identifier?: Yes. CVE-2026-0421 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2664.
When was CVE-2026-0421 published?: CVE-2026-0421 was published on 2026-01-14 and last updated on 2026-06-17.

References

https://support.lenovo.com/us/en/product_security/LEN-210688

Other CWE-252 vulnerabilities

CVE-2025-66565 — Critical (CVSS 9.8): Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's…
CVE-2021-38171 — Critical (CVSS 9.8): adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a…
CVE-2021-26955 — Critical (CVSS 9.8): An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because…
CVE-1999-0199 — Critical (CVSS 9.8): manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return…
CVE-2019-15900 — Critical (CVSS 9.8): An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without…
CVE-2010-0211 — Critical (CVSS 9.8): The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the…

Browse all CWE-252 vulnerabilities →