SNMP4J-Agent CVE-2026-39006

Exploitation requires the target to be running SNMP4J-Agent 3.8.3 with the snmp4jCfgStoragePath component reachable by the attacker - either exposed over the SNMP management interface or set via an input channel the attacker can influence. The CVSS vector asserts AV:N/AC:L/PR:N/UI:N, meaning no authentication or user interaction in the rated scenario, but CWE-73 (External Control of File Name or Path) combined with the fact that 'Cfg' implies a configuration property suggests realistic exploitation may depend on whether the deploying application exposes that property to remote callers (e.g., via an SNMP SET, management UI, or unauthenticated config endpoint); deployments that hard-code the storage path internally would not be exploitable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) describes unauthenticated remote code execution with low complexity, which would normally make this a top-priority issue, but supplemental signals temper that urgency: EPSS is only 0.21% (11th percentile), the vulnerability is not in CISA KEV, and no exploitation telemetry is referenced. SSVC-style assessment would rate technical impact as Total and automatability as plausible, but exploitation status appears to be 'none' based on available data. A notable conflict exists between the CVSS PR:N rating and the fact that snmp4jCfgStoragePath is typically a configuration property - if exploitation actually requires write access to the agent's configuration file rather than purely a network-reachable input, the real attack vector may be local/authenticated rather than remote unauthenticated; this should be verified against the GitHub advisory before treating as a wormable RCE.

A remote attacker reaches an exposed SNMP4J-Agent 3.8.3 instance and supplies a crafted value for the snmp4jCfgStoragePath component, causing the agent to write attacker-controlled content to an arbitrary filesystem location such as a Java classpath directory, startup script, or cron path. On the next process load the planted file is executed in the agent's security context, giving the attacker code execution on the host. No public exploit identified at time of analysis, but a third-party security advisory describing the issue is published on GitHub.