CVE Alert: CVE-2026-89147 – net-snmp – Net

Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listener and send no data, causing the single-threaded snmpd main loop to block indefinitely and suspend all SNMP processing.

High operational risk: confirm KEV and SSVC status immediately, as active exploitation would require priority handling.

An unauthenticated network connection can halt the SNMP daemon’s processing, disrupting monitoring, alerting and management visibility. The likely attacker objective is service outage or suppression of telemetry during a wider intrusion; confidentiality and integrity impacts appear limited.

### Most likely attack path

The path is network-based, low-complexity, requires no privileges or user interaction, and depends only on reachability of the SMUX listener. Scope is unchanged, so direct impact remains on the host, although loss of monitoring can enable lateral movement elsewhere.

### Who is most exposed

Internet-facing or broadly reachable infrastructure devices, servers and appliances running SNMP are most exposed, particularly where SMUX is enabled unnecessarily. Shared management networks with weak segmentation increase the operational blast radius.

Alert on inbound connections to the SMUX service from unapproved sources.

Identify established connections that remain silent or unusually long-lived.

Monitor for stalled `snmpd` processes and gaps in polling or trap delivery.

Correlate service restarts, watchdog events and monitoring blind spots.

### Mitigation and prioritisation

Apply the vendor or distribution fix promptly; use an expedited change where SMUX is externally reachable.

Disable SMUX if not required, or restrict it to explicitly authorised management peers.

Enforce network ACLs and segmentation; never expose the listener to untrusted networks.

Validate monitoring continuity and have a restart or failover procedure ready.

EPSS, PoC and exploitation-state data are not provided; obtain them before final risk acceptance.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.