Ibm Datapower Gateway vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Ibm Datapower Gateway: 43 record(s), with affected versions and fixes.cpe:2.3:a:ibm:datapower_gateway
CVE-2026-15784
High · 8.1
CWE-787 Oct 8, 2026
IBM DataPower Gateway Out-of-bounds Write
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
CVE-2026-15781
High · 8.0
CWE-121 Oct 8, 2026
IBM DataPower Gateway Buffer Overflow
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-15762
Critical · 9.8
CWE-787 Oct 8, 2026
IBM DataPower Gateway Out-of-bounds Write
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
CVE-2026-14991
Critical · 9.8
CWE-787 Oct 8, 2026
IBM DataPower Gateway Out-of-bounds Write
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
CVE-2026-16340
Critical · 9.8
CWE-787 Oct 8, 2026
IBM DataPower Gateway Out-of-bounds Write
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser.
CVE-2026-16182
Medium · 5.9
CWE-476 Oct 8, 2026
IBM DataPower Gateway NULL Pointer Dereference
IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable processing.
CVE-2026-16181
High · 7.4
CWE-285 Oct 8, 2026
IBM DataPower Gateway Improper Authorization
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass security restrictions due to improper authorization.
CVE-2026-16179
High · 7.5
CWE-124 Oct 8, 2026
IBM DataPower Gateway Buffer Underwrite
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.
CVE-2026-16178
High · 7.5
CWE-787 Oct 8, 2026
IBM DataPower Gateway Out-of-bounds Write
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validation.
CVE-2026-16177
Medium · 5.3
CWE-125 Oct 8, 2026
IBM DataPower Gateway Out-of-bounds Read
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.
CVE-2026-16176
High · 7.5
CWE-770 Oct 8, 2026
IBM DataPower Gateway Denial of Service
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation.
CVE-2026-16170
High · 7.5
CWE-787 Oct 8, 2026
IBM DataPower Gateway Out-of-bounds Write
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
CVE-2026-16169
High · 7.5
CWE-400 Oct 8, 2026
IBM DataPower Gateway Denial of Service
IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-14521
Medium · 4.9
CWE-918 Oct 8, 2026
IBM DataPower Gateway affected by server-side request forgery
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVE-2026-7366
Medium · 4.2
CWE-362 Aug 12, 2026
IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall
IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses.
CVE-2026-12733
High · 7.5
CWE-770 Jul 30, 2026
IBM DataPower Gateway affected by denial of service
IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.
CVE-2025-36375
High · 8.8
CWE-352 Apr 1, 2026
IBM DataPower Gateway vulnerable to CSRF
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVE-2025-36373
Medium · 6.8
CWE-497 Apr 1, 2026
Incorrect administrative access control in IBM DataPower Gateway
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user.