NETSCALER ADC · CVE-2026-107407 · Infrastructure
FIX → 14.1-73.57 · 13.1-64.39 +2 ✓ verified
Memory overflow (CWE-119) in SMPP traffic handling in NetScaler ADC can cause unpredictable behavior or denial of service. Exploitable only when a Load Balancing or Content Switching virtual server of type SMPP is configured. CVSS v4 9.3, network, no auth. Vendor reports no exploitation.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Customer-managed NetScaler ADC appliances (also Secure Private Access Hybrid NetScaler instances) that run a load-balancing or content-switching virtual server of type SMPP, for example in SMS gateway setups. Everyone else, and Citrix-managed cloud services, can skip it.
Not affected if managed-hosting, no-smpp-vserver
Who cares netscaler, netscaler-adc, netscaler-gateway, self-hosted, smpp
add lb vserver .* SMPP or add cs vserver .* SMPPMemory overflow in SMPP traffic can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 14.1-73.57 · 13.1-64.39 +2