CVE-2026-6281 is an OS command injection vulnerability (CWE-78) affecting Lenovo Personal Cloud T2s devices. It allows a remote authenticated user on the local network to execute arbitrary commands on the device due to improper neutralization of special elements used in OS commands. The CVSS 4.0 score of 8.7 reflects high impact with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published but no official remediation or patch is currently available from Lenovo. Exploitation requires local network access and valid user credentials.

Successful exploitation could allow an authenticated attacker on the local network to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the device's confidentiality, integrity, and availability. This could result in unauthorized control over the device and access to stored data.

Patch status is not yet confirmed — check the Lenovo vendor advisory for current remediation guidance. Until an official fix is released, restrict local network access to trusted users only and monitor for suspicious activity. No official patch or workaround has been provided by Lenovo at this time.