What is the CVSS score of CVE-2026-37579?

CVE-2026-37579 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of SMSGate sms-core are affected by CVE-2026-37579?

SMSGate sms-core versions 2.1.13.6 and earlier contain a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code on affected systems through CMPP protocol…

How to fix or mitigate CVE-2026-37579?

Within 24 hours: Identify and inventory all systems running SMSGate sms-core versions ≤2.1.13.6 in production and non-production environments. Within 7 days: Restrict network access to CMPP protocol interface (typically ports 7891-7892) to documented trusted IP ranges only; deploy network-based detection signatures for malformed CMPP Cmpp7FDeliverRequestMessage payloads; enable comprehensive logging and alerting on CMPP connection attempts and message codec errors. Within 30 days: Contact SMSGate vendor to confirm patch release timeline and obtain upgraded binaries; execute controlled testing and rollout plan for patched versions; document all interim mitigations for risk acceptance review.

SMSGate sms-core CVE-2026-37579

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-28 cve@mitre.org

Java RCE Deserialization

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 22:30 vuln.today

CVSS changed

May 29, 2026 - 20:22 NVD

7.3 (HIGH)

CVE Published

May 28, 2026 - 14:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in SMSGate sms-core<=2.1.13.6 allows a remote attacker to execute arbitrary code via the Cmpp7FDeliverRequestMessageCodec.java component

AnalysisAI

Remote code execution in SMSGate sms-core versions 2.1.13.6 and earlier allows remote attackers to execute arbitrary code by sending crafted input to the Cmpp7FDeliverRequestMessageCodec.java component, which handles CMPP protocol message decoding. The CVSS 7.3 (AV:N/AC:L/PR:N/UI:N) vector indicates network-reachable, unauthenticated exploitation with low complexity, though EPSS scores this at only 0.06% (18th percentile) and there is no public exploit identified at time of analysis. SSVC indicates exploitation status is 'none' but the issue is automatable with partial technical impact across CIA.

Technical ContextAI

SMSGate is a Java-based SMS gateway implementation, and sms-core is the underlying library that handles the China Mobile Peer to Peer (CMPP) short-message protocol used by Chinese telecom carriers. The vulnerable Cmpp7FDeliverRequestMessageCodec.java class is a codec responsible for decoding inbound CMPP DELIVER (0x7F-family) message frames from network peers. The referenced advisory describes a deserialization vulnerability, consistent with the 'RCE' and 'Java' tags - a classic pattern where untrusted protocol input is passed to Java object deserialization (e.g., ObjectInputStream or a similar mechanism) without type validation, enabling gadget-chain-based arbitrary code execution. No CWE was assigned by NVD, but the behavior is consistent with CWE-502 (Deserialization of Untrusted Data).

Affected ProductsAI

SMSGate sms-core library at versions 2.1.13.6 and earlier are affected, specifically the Cmpp7FDeliverRequestMessageCodec.java component that processes CMPP DELIVER protocol messages. No official CPE has been published by NVD at time of analysis, and no vendor security advisory URL is provided - the sole reference is a third-party write-up at https://github.com/wudijun/jun.github.io/blob/main/SMSGate%20deserialization%20vulnerability.md which security teams should consult for technical details.

RemediationAI

No vendor-released patch identified at time of analysis; the only public reference is a third-party technical write-up rather than a vendor advisory or tagged release. Organizations running SMSGate sms-core should monitor the upstream project for a release beyond 2.1.13.6 and apply it as soon as available, consulting https://github.com/wudijun/jun.github.io/blob/main/SMSGate%20deserialization%20vulnerability.md for indicators. As compensating controls, restrict inbound CMPP connections to an allowlist of trusted carrier ISMG peer IP addresses at the firewall (trade-off: breaks any new peer onboarding until the allowlist is updated), terminate CMPP traffic through an authenticated reverse proxy or VPN that validates peer identity before it reaches the codec (trade-off: adds latency and operational complexity), and if the deserialization path uses standard Java ObjectInputStream, deploy a JVM-level deserialization allowlist via the jdk.serialFilter system property to block known gadget classes such as those from commons-collections, commons-beanutils, and Spring (trade-off: may break legitimate serialized payloads and requires careful filter tuning).