CVE-2026-39006 Details

A remote code execution vulnerability exists in SNMP4J-Agent version 3.8.3. The issue arises in the default configuration of the SampleAgent, where the SNMPv1/v2c community 'public' is granted unrestricted write access. This allows remote attackers to manipulate the 'snmp4jCfgStoragePath' component, triggering storage or restoration operations that can lead to arbitrary code execution via Java deserialization. Additionally, the vulnerability can be exploited to write or overwrite files at specified local paths.

To mitigate this vulnerability, it is recommended to remove default write privileges from the SNMPv1/v2c community in both sample and production configurations. Persistent storage paths should be restricted to a safe directory, and Java native deserialization should be replaced with a safer format or controlled using an 'ObjectInputFilter' allowlist. Additionally, enable source address filtering for SNMPv1/v2c where applicable.