1. Executive summary
CISA published ICSA-26-265-01 on 2026-09-22 covering CVE-2026-87121, an out-of-bounds write (CWE-787) in the lwIP TCP/IP Stack MQTT Client Application affecting versions 2.0.1 through 2.2.1. The vulnerability carries a CVSS v3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 base score of 9.3 (CRITICAL). Successful exploitation allows an attacker to gain full code execution on the device. CISA states no known public exploitation targeting this vulnerability has been reported at this time, and the advisory does not list the flaw on CISA KEV. lwIP is embedded in networked devices across multiple critical infrastructure sectors, including Financial Services, so the exposure for EMEA financial institutions runs through third-party embedded and IoT device supply chains rather than core banking software.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The advisory discloses a critical vulnerability in a third-party embedded component with no reported exploitation, no observed incident, and no confirmed affected deployments inside any client estate. If a client's asset inventory identifies lwIP-based MQTT client firmware in production, DORA Art. 28 (ICT third-party risk — general principles) and DORA Art. 30 (key contractual provisions with ICT third-party providers) become relevant to vendor patch obligations, but that trigger is contingent on inventory findings, not on this advisory alone.
3. Technical analysis & attack chain
CVE-2026-87121 is an out-of-bounds write in the lwIP MQTT Client Application, affecting versions 2.0.1 through 2.2.1. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable flaw requiring no privileges and no user interaction, with high impact on confidentiality, integrity and availability. An attacker who can reach the MQTT client over the network can corrupt memory outside the intended buffer bounds and, per CISA, gain full code execution on the device. The advisory does not specify the exact code path, the MQTT message element that triggers the write, or the affected source file, so defenders cannot yet distinguish which MQTT operations (connect, publish, subscribe, or inbound payload handling) are the trigger. That detail is absent from both the CISA advisory text and the external source.
A confirmed attack chain, limited to what the sources state:
- The attacker identifies a device running the lwIP MQTT Client Application, version 2.0.1 to 2.2.1, reachable over the network.
- The attacker sends input that triggers the out-of-bounds write in the MQTT client code path.
- Memory corruption leads to full code execution on the device, with high impact on confidentiality, integrity and availability per the CVSS vector.
No further chain steps (persistence, lateral movement, exfiltration) are described in the source material, and none should be assumed. The advisory gives no indication of ransomware or extortion behaviour.
A companion advisory, ICSA-26-265-02, covers a separate double free flaw (CWE-415) in lwIP itself, fixed in commit f873b6295933e4149a2132adf3e9a2d2a676a5ec, scored CVSS v3.1 8.8 (HIGH) with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That flaw is adjacent-network only and CISA states it is not exploitable remotely. It is a distinct vulnerability in a distinct component and should not be conflated with CVE-2026-87121.
Attribution: no threat actor is named in any source. The vulnerability was reported to CISA by Shahriyar Jalayeri of ByteRay Ltd., a researcher, not an attacker. There is no attribution to assess.
Confidence caveat: all technical detail above is single-sourced, resting on the CISA advisory ICSA-26-265-01 and its external page. No vendor advisory, exploit code, or third-party analysis corroborates the mechanism or the affected version range. Verify against the upstream lwIP repository before enforcing version-based blocks.
4. Mitigation & containment
P1 (within 24h)
- Query your asset inventory and firmware manifests for devices embedding the lwIP MQTT Client Application, versions 2.0.1 through 2.2.1. The component is open source and widely vendored, so grep firmware source trees and SBOMs for the lwIP MQTT client rather than relying on vendor product names.
- Identify any MQTT client endpoints on embedded devices that are exposed to untrusted networks. Where exposure exists, block inbound MQTT traffic (TCP port 1883 and 8883) at the segment boundary until patch status is confirmed.
P2 (within 72h)
- Where you control the build, update lwIP to a revision containing commit f89407ea711879c04d91c92b35d67be78bbaf0f1, per the CISA remediation, sourced from the upstream repository at savannah.nongnu.org/projects/lwip.
- Where lwIP is vendored by a device manufacturer, raise the patch request with that vendor under your existing ICT third-party contract terms, citing CVE-2026-87121 and the fix commit.
- Apply CISA's recommended ICS practices to affected device classes: minimise network exposure, place control system networks behind firewalls isolated from business networks, and require VPN access for any remote administration.
P3 (within 7 days)
- Add CVE-2026-87121 and the lwIP version range to your third-party risk questionnaires and SBOM ingestion rules so future device procurement flags the component.
- Separately track the companion lwIP double free flaw (ICSA-26-265-02, fix commit f873b6295933e4149a2132adf3e9a2d2a676a5ec) in the same inventory sweep, since both flaws ship in the same upstream project.
5. Indicators of compromise
No indicators of compromise available in the source material. The advisory describes a vulnerability, not observed exploitation, and provides no hashes, network indicators, or behavioural artefacts.
6. Detection
Insufficient indicators to author detection rules. The sources contain no strings, file paths, command lines, or traffic artefacts belonging to an exploit. The fix commit identifier is a remediation reference, not a threat artefact, and a rule matching it would detect patching activity, not exploitation.
7. Sources
- CISA, ICS Advisory ICSA-26-265-01, lwIP TCP/IP Stack MQTT Client Application, https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-01, 2026-09-22
- CISA, ICS Advisory ICSA-26-265-02, lwIP (Lightweight IP), https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-02, 2026-09-22
8. Adverse Trace position
We assess CVE-2026-87121 as a critical-severity flaw on its published metrics (CVSS v3.1 9.8, CVSS v4.0 9.3, both CRITICAL) with no known public exploitation and no CISA KEV listing, which places it in the patch-on-identification category rather than the active-threat category. The practical risk to EMEA financial services clients is supply-chain exposure: lwIP is an open-source stack embedded in third-party devices, and the affected MQTT client versions will surface in branch peripherals, building management kit, and network appliances before they surface in anything a bank builds itself. The entire technical picture is single-sourced from the CISA advisory, and the trigger path within the MQTT client is not yet public, so we will monitor the upstream lwIP repository, the fix commit f89407ea711879c04d91c92b35d67be78bbaf0f1, and any follow-on vendor advisories for the missing mechanism detail, and we will reissue this note if exploitation is reported or the affected version range changes.
Published via PulseTrace — Adverse Trace threat intelligence.