Cyber ·
USN-9062-1: missing sanitization in SNMPTT allows remote shell command execution
Ubuntu security notice for SNMPTT, an SNMP trap handling tool. Trap data is not sanitized before being passed to the EXEC, PREEXEC and unknown_trap_exec options, which may allow remote execution of shell commands.
Notice USN-9062-1, published on November 11, 2026 in the Ubuntu Security feed, describes a vulnerability in SNMPTT. According to the machine-translated text supplied by the source, SNMPTT did not correctly sanitize trap data passed to commands run by the EXEC, PREEXEC and unknown_trap_exec options. A remote attacker could possibly use this issue to execute arbitrary shell commands. The excerpt available does not state the affected versions or the fixes applied.
The relevance for infrastructure operators is direct: if SNMPTT receives traps from equipment or networks you do not control, the attack surface includes the trap data itself. To check exposure, consult the official notice on the Ubuntu site, identify whether the snmptt package is installed and at which version, and confirm whether the cited options are configured in your environment.
Rota Nacional does not fix or mitigate this vulnerability and does not replace package updates. If your team uses AI to study the notice or draft verification scripts, do not paste internal hostnames, addresses, credentials or real trap contents; use fictitious examples.