lwIP MQTT client gets CISA advisory, CVSS 9.8
The vulnerable MQTT client ships in millions of embedded devices across critical infrastructure, and there's no firmware yet, just a source commit.
TL;DR
CISA published an ICS advisory for an out-of-bounds write (CVE-2026-87121, CVSS 9.8) in the lwIP TCP/IP Stack MQTT Client Application, versions 2.0.1 through 2.2.1. Successful exploitation allows remote code execution on affected devices. The advisory lists deployment across eight critical infrastructure sectors (chemical, communications, critical manufacturing, energy, financial services, healthcare and public health, transportation systems, and water and wastewater) worldwide. The fix is a single commit in the lwIP repository. Device vendors haven't shipped integrated firmware updates yet.
The advisory hit CISA's ICS feed Tuesday with the kind of metrics that should interrupt a patching cycle: CVSS 3.1 score of 9.8, network-accessible, no privileges required, no user interaction. CVE-2026-87121 is an out-of-bounds write in the lwIP MQTT Client Application. The affected range is 2.0.1 through 2.2.1.
lwIP is a lightweight TCP/IP stack designed for embedded systems, it runs in devices that often don't get regular firmware updates and where the security model assumes the network is segmented, not hostile. A 9.8 in that deployment profile is worse than the same score in enterprise software: the devices stay vulnerable longer, often invisibly.
The sectors CISA named are not boilerplate
The advisory's background section lists chemical, communications, critical manufacturing, energy, financial services, healthcare and public health, transportation systems, and water and wastewater as sectors where affected products are deployed. That's not a generic ICS advisory header, it's eight distinct CI sectors, all of which the U.S. government has formally designated as critical infrastructure. When a single vulnerability crosses that many sector boundaries through a common embedded stack, the surface area is real.
CISA credited Shahriyar Jalayeri of ByteRay Ltd. for the discovery. No exploitation in the wild has been reported to CISA as of the initial publication date, September 22, 2026.
The fix exists, the distribution doesn't
The lwIP project has committed the patch (commit f89407ea711879c04d91c92b35d67be78bbaf0f1) to its repository. For organizations that build from source or maintain their own firmware, that commit is actionable immediately.
For everyone else, the timeline depends on device vendors integrating the fix into their firmware builds, testing it against their hardware, and shipping updates, a process that in embedded ICS/OT environments often measures in months, not days. CISA's recommended mitigations (network segmentation, VPNs, firewalls) remain the bridge between now and whenever vendor firmware arrives.
Published ·Deep Fathom