Vulnerability · Published May 13, 2026 · Assigned by lenovo
CVE-2026-6281
High 8.8
In plain English
A high-severity OS command injection in Home Storage Hub T20 from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 61.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Personal Cloud T2s | 0 – before 5.5.6.t2s.3 |
| Lenovo | Personal Cloud T2Pro | 0 – before 5.4.8.t2pro.2 |
| Lenovo | Personal Cloud X1s | 0 – before 5.4.8.x1s.2 |
| Lenovo | Home Storage Hub T20 | 0 – before 5.5.8.t20.1 |
| Lenovo | Home Storage Hub X20 | 0 – before 5.4.4.x20.1 |
| Lenovo | Personal Cloud T1 | 0 – through 5.4.0.t1.6 |
| Lenovo | Personal Cloud A1 | 0 – through 5.4.2.a1.3 |
| Lenovo | Personal Cloud A1s | 0 – through 5.5.6.a1s |
| Lenovo | Personal Cloud T2 | 0 – through 5.4.5.t2.2 |
| Lenovo | Personal Cloud X1 | 0 – through 5.4.7.x1.1 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H