VulnSocial

CVE-2026-87121Active Exploitation

LOWCVSS 9.3 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-787

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-22); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-22: 1Mentions · 2026-09-23: 1Active Exploitation · 2026-09-22: 1Technical Details · 2026-09-22: 1Technical Details · 2026-09-23: 109-2209-23
Signal classification2 categories
Active Exploitation
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-221
Active Exploitation1
2026-09-231
Disclosure1
Full discourse2 posts
  • Izuma Networks@IzumaNetworks
    Disclosure

    IoT risk isn’t only in the app. CISA flagged a critical flaw in lwIP’s MQTT client (CVE-2026-87121, CVSS 9.8)—out-of-bounds write that can mean full code execution on the device. https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-01

    Post summary

    The text discloses a critical vulnerability (CVE-2026-87121) in lwIP's MQTT client highlighted by a CISA ICS advisory, detailing an out-of-bounds write vulnerability with a CVSS 9.8 score leading to remote code execution, without mentioning patches, exploits, or active exploitation.

    0000047
    8 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    Attackers exploiting CVE-2026-87121 in lwIP MQTT clients can achieve remote code execution without authentication across industrial networks. This critical vulnerability demonstrates how unencrypted industrial protocols enable lateral movement between compromised IoT devices. Runtime segmentation helps contain post-compromise activity. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/lwip-mqtt-cve-2026-87121-out-of-bounds-write-vulnerability

    Post summary

    The tweet explicitly reports active exploitation of CVE-2026-87121, enabling unauthenticated remote code execution in lwIP MQTT clients across industrial networks, with no mention of PoC code, exploit tools, patches, or workarounds.

    0000036
    2.0K followersView on X

Explore more

Back to dashboard