CVE-2026-39006: An issue in SNMP4J-Agent 3

Synopsis

Remote code execution vulnerability in SNMP4J-Agent 3.8.3 allows an unauthenticated attacker to reach the affected service over a network and exploit the snmp4jCfgStoragePath component. No authentication or user interaction is required, and successful exploitation gives the attacker full control to execute arbitrary code on the host. HarborGuard is tracking the advisory for patch availability, and detection is available now for any images containing the affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SNMP4J-Agent service over the network; the vulnerability is remotely exploitable with no requirement for local or physical access.

• AuthenticationNot required

  No credentials or prior account access are needed; the attacker can interact with the vulnerable component as an anonymous, unauthenticated party.

• Victim interactionNot required

  No action from a user or operator on the target system is required to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Attacker executes arbitrary code on the host running SNMP4J-Agent, gaining full process-level control.
• Confidential data accessible to the agent process, including configuration files and secrets stored on disk, is exposed to the attacker.
• The attacker can write or overwrite files and application state, compromising the integrity of the running service and any data it manages.
• The attacker can terminate or destabilize the agent process, disrupting SNMP-based monitoring and management functions dependent on that service.