Our takeCISA reports active exploitation of CVE-2026-15340, a buffer overflow in Savannah lwIP SMTP client 2.2.1 that can crash devices or enable remote code execution (CVSS 9.8). Update to a fixed version now if you run this in embedded or industrial systems.Cyber Resilience desk
Sources (2)
- cisa_ics · cisa_ics
- cisa_advisories · cisa_advisories
What this means for you — Security leader:CISA reports a critical buffer overflow (CVE-2026-15340, CVSS 9.8) in Savannah lwIP SMTP client 2.2.1 that can crash devices or enable remote code execution. Update to a fixed version immediately if you use this library in embedded or OT systems.
What this means for you — Lean IT orgs:If your devices or equipment use the Savannah lwIP SMTP client version 2.2.1, this flaw lets attackers crash the device or run code remotely. Check with your equipment vendor or manufacturer for an update right away.
What this means for you — MSP:CISA advisory ICSA-26-279-02 flags active exploitation risk in Savannah lwIP SMTP client 2.2.1 (CVE-2026-15340). Scan client portfolios for this embedded library and push updates; many OT and industrial devices ship it.
What this means for you — Researcher:CISA reports active exploitation of CVE-2026-15340, a buffer overflow in Savannah lwIP SMTP client 2.2.1 that enables remote code execution or device crash. Fixed builds are available per the advisory.