CVE-2026-8741

low

Published 2026-05-17 · Modified 2026-05-20

CVSS v3

3.1

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CVSS v2

2.1

VIR risk

3.1

Description

A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqx_persistent_session_ds.erl of the component QoS 2 PUBLISH Packet Handler. Such manipulation leads to race condition. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

Predictions

Exploit likelihood

42%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cna@vuldb.com — https://github.com/Pathfind-tama/Report_EMQX_MQTT/blob/main/MQTT%20QoS%202%20Message%20Duplication%20in%20Persistent%20Sessions.md

Application impact

Vendor	Product	Versions	Fixed
emqx	emqx	`{"startIncluding":"5.0.0","endIncluding":"6.2.0"}`

References

CWEs

CWE-362

Verify integrity in audit chain (admin only). AS-IS.