The fix for a critical flaw in lwIP is not a patch you download. It is a git commit, f89407ea711879c04d91c92b35d67be78bbaf0f1, and every company that compiled lwIP into a product has to pick it up and ship a new build before any of their customers see it.
That is the awkward part of the two advisories CISA published on 22 September. lwIP, short for Lightweight IP, is a small open-source TCP/IP stack written for devices with very little memory, and it ends up inside sensors, controllers, meters and gateways rather than in anything with an update button. CISA lists its deployment as worldwide across chemical, communications, critical manufacturing, energy, financial services, healthcare, transportation, and water and wastewater.
A 9.8 in the MQTT client
The more serious of the two is CVE-2026-87121, an out-of-bounds write in the lwIP MQTT client application, rated 9.8 under CVSS v3.1 and 9.3 under v4.0. CISA's advisory states that successful exploitation could allow an attacker to gain full code execution on the device, and the v3.1 vector describes it as reachable across the network with no privileges and no user interaction. Versions 2.0.1 through 2.2.1 of the MQTT client are affected. Shahriyar Jalayeri of ByteRay Ltd reported it.
MQTT is the lightweight messaging protocol most industrial telemetry rides on, which means the vulnerable code path is the one the device uses for its day job.
The second flaw needs to be on your network
CVE-2026-91018 is a double free in the lwIP API itself, affecting the same 2.0.1 to 2.2.1 range, rated 8.8 under v3.1 and 8.7 under v4.0. The second advisory says it could crash the system, cause a denial of service, corrupt memory or allow code execution, and it explicitly notes the flaw is not exploitable remotely: the vector is adjacent-network, so an attacker needs a foothold on the same segment first. Eric Evenchick of Tetrel Security reported this one. Its fix is commit f873b6295933e4149a2132adf3e9a2d2a676a5ec.
CISA says no public exploitation targeting either flaw has been reported to it.
Rebuild, or put a boundary around it
There is no vendor bulletin to wait for here, because lwIP is not sold by a vendor. Device makers should pull the two fix commits from the lwIP repository and rebuild. Asset owners, who mostly cannot do that, are left with the boundary controls CISA recommends for every ICS advisory: keep control-system devices off the internet, put them behind firewalls and away from business networks, and use a VPN for remote access while remembering a VPN is only as safe as whatever connects through it.
The practical first step is knowing where lwIP actually runs in your estate. Most organizations do not, because it arrived as somebody else's firmware. Software bills of materials exist for exactly this question, and an advisory that ships a commit hash instead of a version number is the clearest argument for having one.
Embedded network stacks keep producing this pattern. We have covered root-level flaws in T-Mobile 5G routers and a maritime satellite router with a public exploit and no patch, and in both cases the gap between a fix existing and a fix reaching the device was measured in vendors, not days.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.