Will CVE-2026-15340 (lwIP SMTP RCE) be actively exploited by Dec 2026?

CISA alerts that Savannah lwIP SMTP client 2.2.1 (CVE-2026-15340, CVSS 9.8) contains a buffer overflow enabling remote code execution. This vulnerability affects embedded systems and IoT devices using lwIP.

Resolution Criteria

Confirmed active exploitation documented in public PoC release, vendor advisory on exploitation, or security vendor threat intel reporting live attacks targeting lwIP SMTP services. CISA KEV addition is not required but would support YES.