Is CVE-2026-8741 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8741 being exploited in the wild.

How severe is CVE-2026-8741?

Low severity, with a CVSS score of 3.1, published 17 May 2026.

Is there a fix for CVE-2026-8741?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8741 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8741?

Check whether you run EMQX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8741: EMQX race condition in QoS 2 PUBLISH Packet Handler

CVE-2026-8741 · Severity: low · CVSS 3.1 · Published 2026-05-17

EMQX is an open-source MQTT broker used to connect and manage large numbers of IoT devices. A flaw in how the broker handles high-priority messages (QoS 2) can lead to a race condition where messages are delivered more than once, despite a protocol guarantee of 'exactly once' delivery. In practice, this could result in duplicate business transactions, such as double-processing a payment or repeating a command to an industrial device, potentially corrupting application state or causing operational errors.

Vendors: EMQX.

Quick answers

Is CVE-2026-8741 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8741 being exploited in the wild.
How severe is CVE-2026-8741?: Low severity, with a CVSS score of 3.1, published 17 May 2026.
Which products and versions are affected?: EMQX up to 6.2.0.
Is there a fix for CVE-2026-8741?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8741 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8741?: Check whether you run EMQX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in the QoS 2 PUBLISH packet handler within 'apps/emqx/src/emqx_persistent_session_ds.erl'. The broker publishes messages to subscribers before the PacketId is committed to persistent storage. Because the state commit is handled asynchronously via a timer ('ensure_state_commit_timer'), a broker crash or client reconnection occurring before the timer fires results in the PacketId not being persisted. Upon reconnection, a client retransmission of the same PacketId is treated as a new message, leading to duplicate delivery. This vulnerability affects EMQX versions up to 6.2.0 when using persistent sessions (DS storage). While the vendor has acknowledged the behavior, there is currently no official fix timeline, and users are advised to implement application-level deduplication.

Affected products

EMQX EMQX up to 6.2.0

Timeline

2026-05-17: disclosed: Public disclosure of the vulnerability and exploit details.
2026-05-17: advisory: NVD and VulDB published the advisory.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.