{"id":"CVE-2026-107407","kind":"vulnerability","aliases":["CVE-2026-107407"],"related":[],"title":"NetScaler ADC: memory overflow in SMPP load-balancing traffic can crash the appliance","description":"Memory overflow in SMPP traffic can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.","summary":"Memory overflow (CWE-119) in SMPP traffic handling in NetScaler ADC can cause unpredictable behavior or denial of service. Exploitable only when a Load Balancing or Content Switching virtual server of type SMPP is configured. CVSS v4 9.3, network, no auth. Vendor reports no exploitation.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57","13.1-64.39","14.1-73.58 FIPS","13.1-37.293"],"affected":"14.1 < 14.1-73.57; 13.1 < 13.1-64.39; 14.1-FIPS < 14.1-73.58; 13.1-FIPS/NDcPP < 13.1-37.293","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","netscaler","netscaler-adc","netscaler-gateway","self-hosted","smpp"],"not_affected_if":["managed-hosting","no-smpp-vserver"],"how_to_check":"Search the NetScaler running config for lines matching 'add lb vserver .* SMPP' or 'add cs vserver .* SMPP'. No match means the precondition is not met.","fix":"Upgrade to 14.1-73.57 or later (14.1), 13.1-64.39 or later (13.1), 14.1-73.58 FIPS or later (14.1-FIPS), 13.1-37.293 or later (13.1-FIPS and 13.1-NDcPP). The vendor bulletin lists no workaround.","status":"open","published_at":"2026-11-13T02:18:49+00:00","first_seen_at":"2026-11-13T02:41:35+00:00","triaged_at":"2026-11-13T02:42:55+00:00","updated_at":"2026-11-13T02:45:17+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-13T02:42:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"NetScaler: SMPP traffic memory overflow enables denial of service or erratic behavior","impact":"medium","summary":"A memory overflow in how NetScaler ADC and NetScaler Gateway handle SMPP traffic can cause unpredictable or erroneous behavior. The flaw can be used to crash the appliance or disrupt its service (denial of service).","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netscaler","netscaler-adc","netscaler-gateway","smpp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance crashes or behaves unpredictably, causing denial of service","analyst_note":"Confirm affected NetScaler versions, fixed builds and whether SMPP processing must be enabled, using the vendor advisory (not in the sources).","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000656,"input_tokens":4519,"output_tokens":408,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm affected NetScaler versions, fixed builds and whether SMPP processing must be enabled, using the vendor advisory (not in the sources).","search":"'-107407':17A,20A '-119':38B '-2026':16A,19A '9.3':72B 'adc':2A,22A,27B,45B,98C 'applianc':14A 'auth':75B 'balanc':9A,59B 'behavior':49B,91C 'caus':47B 'configur':69B 'content':61B 'crash':12A 'cve':15A,18A 'cvss':70B 'cwe':37B 'denial':51B,93C 'erron':90C 'exploit':54B,79B 'gateway':30B,101C 'handl':42B 'host':33B 'infrastructur':23B 'lead':86C 'load':8A,58B 'load-balanc':7A 'memori':3A,35B,80C 'netscal':1A,24B,26B,29B,44B,97C,100C 'netscaler':21A 'netscaler-adc':25B 'netscaler-gateway':28B 'network':73B 'overflow':4A,36B,81C 'report':77B 'self':32B 'self-host':31B 'server':64B 'servic':53B,95C 'smpp':6A,34B,40B,67B,83C 'switch':62B 'traffic':10A,41B,84C 'type':66B 'unpredict':48B,88C 'v4':71B 'vendor':76B 'virtual':63B","nicknames":[],"mitigations":[],"who_affected":"Customer-managed NetScaler ADC appliances (also Secure Private Access Hybrid NetScaler instances) that run a load-balancing or content-switching virtual server of type SMPP, for example in SMS gateway setups. Everyone else, and Citrix-managed cloud services, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T02:45:17Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3804},"products":{"at":"2026-11-13T02:45:17Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3804},"how_to_check":{"at":"2026-11-13T02:45:17Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3804},"who_affected":{"at":"2026-11-13T02:45:17Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3804}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["adc","netscaleradc"],"ptokens":["adc","netscaler"],"labels":["critical","infrastructure","netscaler","netscaleradc","netscalergateway","selfhosted","smpp"],"campaign_type":null,"search_a":"'-107407':17A,20A '-2026':16A,19A 'adc':2A,22A 'applianc':14A 'balanc':9A 'crash':12A 'cve':15A,18A 'load':8A 'load-balanc':7A 'memori':3A 'netscal':1A 'netscaler':21A 'overflow':4A 'smpp':6A 'traffic':10A","search_b":"'-119':38B '9.3':72B 'adc':27B,45B 'auth':75B 'balanc':59B 'behavior':49B 'caus':47B 'configur':69B 'content':61B 'cvss':70B 'cwe':37B 'denial':51B 'exploit':54B,79B 'gateway':30B 'handl':42B 'host':33B 'infrastructur':23B 'load':58B 'memori':35B 'netscal':24B,26B,29B,44B 'netscaler-adc':25B 'netscaler-gateway':28B 'network':73B 'overflow':36B 'report':77B 'self':32B 'self-host':31B 'server':64B 'servic':53B 'smpp':34B,40B,67B 'switch':62B 'traffic':41B 'type':66B 'unpredict':48B 'v4':71B 'vendor':76B 'virtual':63B","search_c":"'adc':98C 'behavior':91C 'denial':93C 'erron':90C 'gateway':101C 'lead':86C 'memori':80C 'netscal':97C,100C 'overflow':81C 'servic':95C 'smpp':83C 'traffic':84C 'unpredict':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T02:18:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107407","severity":null,"published_at":"2026-11-13T02:18:49+00:00","modified_at":"2026-11-13T02:18:49+00:00","first_seen_at":"2026-11-13T02:41:35+00:00","fetched_at":"2026-11-13T02:41:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107407:3804","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T02:45:17+00:00","modified_at":"2026-11-13T02:45:17+00:00","first_seen_at":"2026-11-13T02:45:17+00:00","fetched_at":"2026-11-13T02:45:17+00:00","note":"Read Citrix bulletin CTX697305: SMPP overflow, needs LB/CS vserver of type SMPP; fixed 14.1-73.57, 13.1-64.39, FIPS builds; no workaround stated; no exploitation reported.","cites":["https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin (CTX697305)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}