Open-source package vulnerability · Maven

CVE-2026-39006: SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component

criticalCVSS 3.1 9.8GHSA-7h7j-7vwp-cwfg

An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.

Published Jun 15, 2026 · Updated Aug 26, 2026

Affected packages

org.snmp4j:snmp4j-agent

Ecosystem: Maven
Affected: <= 3.8.3
Fixed in: No patched version yet
Check: mvn dependency:tree -Dincludes=org.snmp4j:snmp4j-agent

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-39006
https://github.com/EaEa0001/security-advisories/blob/main/CVE-2026-39006.md
https://github.com/advisories/GHSA-7h7j-7vwp-cwfg

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology