CVE Intelligence
Analysis AI-assisted

CVE-2026-15762: IBM DataPower Gateway Out-of-bounds Write

IBM DataPower Gateway is affected by CVE-2026-15762, an out-of-bounds write (CWE-787) that the record says could allow a remote attacker to execute arbitrary code. The record assigns a CVSS base score of 9.8 (critical), and the KEV catalog does not list it. The available sources do not confirm a fixed-version list, so the IBM advisory should be consulted before patching decisions are made.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

IBM published CVE-2026-15762 for IBM DataPower Gateway. The record describes an out-of-bounds write classified as CWE-787 that could allow a remote attacker to execute arbitrary code. The vulnerability is documented in the IBM support advisory and in the NVD entry.

Impact

  • The record states that a remote attacker could execute arbitrary code on an affected gateway.
  • The record assigns a CVSS base score of 9.8, which corresponds to a critical severity rating. The vector in the record marks confidentiality, integrity and availability impact as high, and the attack as network-reachable without privileges or user interaction.
  • The SSVC data in the record rates technical impact as total and automatability as yes.

Affected products and versions

  • The description lists DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10 and 11.0.0.0 through 11.0.0.2.
  • The structured affected data in the record uses upper boundaries of 10.5.0.23, 10.6.0.11 and 11.0.0.3. These boundaries overlap in places and should be checked against the IBM advisory before being used for inventory decisions.
  • The record does not contain a fixed-version list. A missing entry here does not mean no fix exists; the IBM advisory is the authoritative source for which builds include the correction.

Exploitation status

  • The KEV catalog does not list this CVE in the record.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability is 0.00516 with a percentile of 0.43121, dated 2026-10-23. These values estimate exploitation likelihood and are not evidence of observed attacks.
  • The SSVC exploitation field is set to none.

Remediation and mitigation

  • Identify all DataPower Gateway instances and their exact builds, and compare them with the ranges in the IBM advisory.
  • Apply the fix described in the IBM advisory to every affected build, prioritizing gateways reachable from untrusted networks.
  • Where patching cannot happen immediately, reduce exposure by limiting which networks can reach the gateway management and service interfaces, following the guidance in the vendor advisory.
  • Confirm after patching that the deployed build is outside the affected ranges.

Detection guidance

  • Monitor gateway logs and host telemetry for unexpected process crashes, restarts or abnormal resource use.
  • Review network traffic directed at gateway services for unusual request patterns from untrusted sources.
  • Keep inventory records current so that affected builds can be identified quickly if new information is published.

Limitations of the available information

  • The record is brief and does not describe the affected component, the trigger condition or the exact vulnerable code path.
  • No fixed-version list is present in the record, so the patched builds must be confirmed with IBM.
  • The affected ranges in the structured data are not fully consistent with each other and require verification.
  • No exploit details or proof-of-concept information are included here, and none should be inferred from this analysis.

Frequently asked questions

What is CVE-2026-15762?

It is an out-of-bounds write (CWE-787) in IBM DataPower Gateway that the record says could allow a remote attacker to execute arbitrary code.

How severe is it according to the record?

The record lists a CVSS base score of 9.8, which is a critical rating. The vector indicates high impact on confidentiality, integrity and availability.

Is this vulnerability known to be exploited?

It is not listed in the KEV catalog in the record, and no confirmed exploitation in the wild appears in the sources consulted.

Which versions are affected?

The description lists 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10 and 11.0.0.0 through 11.0.0.2. Confirm exact builds against the IBM advisory.

What should administrators do?

Check the IBM advisory for the fixed builds, apply the correction to affected gateways and restrict network exposure of management and service interfaces until patching is complete.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.