External risk intelligence

NetScaler ADC and Gateway SMPP Memory Overflow Denial of Service.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-107407

NetScaler ADC and NetScaler Gateway are explicitly designed as internet-facing edge appliances, gateways, and reverse proxies. They are routinely deployed at the network perimeter to handle traffic, making their interfaces, including those handling protocols like SMPP, inherently exposed to the public internet by design in standard configurations.

Denial of Service

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A memory overflow vulnerability has been identified in the handling of SMPP traffic within NetScaler ADC and NetScaler Gateway. This issue could lead to unpredictable system behavior or service disruption. The primary concern is to confirm if these specific technologies are in use and if they are exposed to the potential vulnerability.

SMPP traffic overflow may cause unpredictable behavior.
Confirms use of affected technologies and their exposure.
Assess relevance and potential business impact.

Attack Path

How an attacker could exploit the issue

An attacker could target NetScaler ADC and NetScaler Gateway through network-accessible interfaces, exploiting a flaw in how the system processes SMPP traffic. This memory overflow vulnerability, when triggered, could lead to unexpected system behavior, errors, or a complete denial of service, potentially disrupting critical network services.

No authentication or privileges needed.
Vulnerable SMPP traffic processing.
Denial of service or system errors.

Live Threat

Current exploitation, exposure, and threat context

A memory overflow in the way NetScaler ADC and NetScaler Gateway handle SMPP traffic could lead to unpredictable behavior or service disruption. This could impact the availability of services relying on these devices for traffic management and secure access.

Service availability.
Unpredictable behavior or DoS.
Disruption of network services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This memory overflow vulnerability in SMPP traffic affects NetScaler ADC and NetScaler Gateway, likely making infrastructure and platform teams responsible for its remediation, potentially in coordination with network and security teams. The first practical step involves identifying all instances of the affected technology, assessing their exposure and criticality, and confirming the accountable owner for planning the appropriate response.

Infrastructure and Platform teams own remediation.
Verify affected NetScaler instances and exposure.
Plan maintenance for vendor updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NetScaler ADC and NetScaler Gateway?

NetScaler ADC is a high-performance application delivery controller used to optimize, secure, and control traffic to web applications. NetScaler Gateway provides secure remote access to internal resources. Both are widely deployed as edge appliances to manage connectivity and proxy traffic, acting as a crucial entry point for corporate networks and service infrastructures.

How does this memory overflow vulnerability work?

A memory overflow occurs when a program writes more data to a buffer than it can hold, often overwriting adjacent memory. In CVE-2026-107407, the software fails to correctly handle incoming SMPP traffic. This memory corruption can disrupt normal operations, causing the system to crash, behave unpredictably, or stop responding to legitimate service requests.

Does any SMPP traffic trigger this bug?

The vulnerability is triggered by specific, malformed SMPP traffic that the system cannot process safely. It is not caused by valid, standard traffic patterns. An attacker must send a specially crafted SMPP packet to the appliance to exploit this overflow condition. Regular, non-malicious SMPP communication does not activate this flaw.

Do I need to worry if my device is internal?

If your NetScaler ADC or Gateway is purely internal, your risk is lower but not zero, as an attacker would need access to your internal network. However, Halo Surface Signal notes these products are typically deployed as internet-facing edge appliances. Because they sit at the network perimeter to handle external traffic, they are often directly reachable by remote attackers.

What should I do first to respond to CVE-2026-107407?

Begin by creating a complete inventory of your NetScaler ADC and NetScaler Gateway instances. Determine which units are currently running and identify their network placement. Once you have a clear list of assets, coordinate with your network and infrastructure teams to assess business criticality and prepare for necessary vendor maintenance or security updates.

References

support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.