{"id":"CVE-2026-39006","aliases":["EUVD-2026-36759","GHSA-7h7j-7vwp-cwfg"],"status":"published","title":"SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component","description":"An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00515,"percentile":0.44196,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-502","CWE-73"],"published":"2026-06-15T00:00:00Z","modified":"2026-08-26T15:11:21Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.snmp4j:snmp4j-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.8.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.snmp4j:snmp4j-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.8.3"}]}],"versions":["1.1.1","1.2","1.3.1","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","3.0.0","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.2.0","3.2.1","3.2.2","3.2.3","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.7.0","3.7.1","3.7.2","3.8.0","3.8.1","3.8.2","3.8.3"]}],"references":[{"url":"https://github.com/EaEa0001/security-advisories/blob/main/CVE-2026-39006.md","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39006","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7h7j-7vwp-cwfg"},{"url":"scm:git:git@nmp.app:snmp4j-agent.git","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-39006","description":"An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.","status":"published","published":"2026-06-15T00:00:00Z","modified":"2026-06-16T13:49:15.063Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-284","CWE-73","CWE-502"],"updated_at":"2026-11-02T14:20:02.290587Z"}],"euvd":[{"id":"EUVD-2026-36759","description":"An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.","status":"published","published":"2026-06-15T00:00:00Z","modified":"2026-06-16T13:49:15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:40.605509Z"}],"ghsa":[{"id":"GHSA-7h7j-7vwp-cwfg","title":"SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component","description":"An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.","status":"published","published":"2026-06-15T21:30:39Z","modified":"2026-08-26T14:53:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:41:07.031507Z"}],"nvd":[{"id":"CVE-2026-39006","description":"An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.","status":"published","published":"2026-06-15T20:16:27.217Z","modified":"2026-06-17T10:41:49.757Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-73","CWE-284","CWE-502"],"updated_at":"2026-11-02T14:12:23.846948Z"}],"osv":[{"id":"GHSA-7h7j-7vwp-cwfg","title":"SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component","description":"An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.","status":"published","published":"2026-06-15T21:30:39Z","modified":"2026-08-26T15:11:21.424625Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T15:46:41.002603Z"}]}}