CVE-2026-37579

Technical summary

The vulnerability exists in the Cmpp7FDeliverRequestMessageCodec.java component of SMSGate sms-core and involves unsafe deserialization of CMPP7 protocol messages (CWE-502). The flaw allows remote code execution when a specially crafted CMPP7 deliver request message is processed. The network-accessible nature of SMS gateway services, combined with the absence of authentication requirements to trigger the vulnerability, creates a direct path for remote exploitation.

Business impact

SMS gateways are critical infrastructure for transactional messaging, two-factor authentication delivery, and business communications. Compromise of an SMS gateway through this vulnerability could enable attackers to intercept legitimate SMS messages, inject fraudulent messages, disrupt authentication flows for customer accounts, or use the compromised gateway as a pivot point into broader telecommunications infrastructure. For organizations relying on SMS for security-critical functions, this represents a significant operational and security risk.

Affected systems

SMSGate sms-core versions 2.1.13.6 and earlier are affected. Organizations should verify their exact SMSGate deployment version against the vendor advisory to determine if their instances fall within the vulnerable range. The vulnerability applies to any system running a susceptible version and exposed to network-based CMPP7 message traffic.

Exploitability

This vulnerability is readily exploitable. The attack requires no authentication, no special privileges, and no user interaction. An attacker with network access to the SMS gateway (whether internal or via direct internet exposure) can send a malicious CMPP7 message to trigger arbitrary code execution. The CVSS score of 7.3 (HIGH) reflects the combination of network accessibility, low attack complexity, and significant impact on confidentiality, integrity, and availability.

Remediation

Upgrade SMSGate sms-core to a patched version beyond 2.1.13.6. Verify the specific patch version through the vendor advisory and test in a non-production environment before deployment. As an interim measure, restrict network access to SMS gateway services using firewall rules to limit CMPP7 traffic to trusted peer systems only.

Patch guidance

Contact SMSGate or check their official advisory for the minimum patched version that addresses CVE-2026-37579. Apply patches during a maintenance window when SMS gateway downtime is acceptable. Verify patch installation by confirming the version number post-update and by testing CMPP7 message processing with benign traffic. Document the patch date and version for compliance and audit purposes.

Detection guidance

Monitor for unusual CMPP7 message patterns or malformed deliver request messages sent to the SMS gateway. Implement network-based intrusion detection signatures targeting CVE-2026-37579 exploitation attempts if available from your IDS vendor. Review SMS gateway logs for unexpected process execution, failed message parsing errors, or anomalous system behavior correlated with incoming CMPP7 traffic. Consider deploying Web Application Firewalls or protocol analyzers at the SMS gateway perimeter to validate CMPP7 message structure before processing.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH severity, unauthenticated remote code execution capability, and the critical nature of SMS gateway services in security and business operations. The absence of authentication requirements, network accessibility, and straightforward exploitability make this a prime target for both opportunistic and sophisticated threat actors. Organizations should prioritize patching or mitigating this vulnerability ahead of other medium-severity issues.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects: network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and impact to confidentiality, integrity, and availability (C:L/I:L/A:L). While the scope is unchanged, the combination of easy accessibility and code execution capability elevates this to HIGH severity. Organizations with internet-facing or internally networked SMS gateways face substantial risk.

Frequently asked questions