IBM DataPower Gateway CVE-2025-36374

Exploitation requires a high-privilege authenticated session on IBM DataPower Gateway (PR:H per CVSS vector) - the attacker must control an account with sufficient rights to submit or configure XML processing policies or service definitions on the gateway. The vulnerability is triggered during XML data processing, meaning the privileged user must be able to supply or inject XML input into a processing pipeline. Exploitation is limited by the authentication requirement: unauthenticated remote attackers cannot exploit this vulnerability. There is no indication that a non-default configuration is required beyond having the XML processing capability active, which is a standard operational mode for this product.

The CVSS 3.1 base score of 5.5 (Medium) is justified primarily by the PR:H requirement, which constrains exploitation to already-privileged users - a significant real-world mitigant. The vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H conveys network-reachable exploitation without user interaction, but the high-privilege prerequisite means the attacker must already hold administrative or operator-level access to the DataPower Gateway management interface. The availability impact is rated High (A:H), reflecting that memory exhaustion can fully disrupt the gateway's API processing function - a significant operational risk for organizations relying on DataPower as a critical integration layer. Confidentiality impact is Low (C:L), meaning partial information disclosure rather than full system compromise. No EPSS score was provided, no KEV listing exists, and no public exploit code has been identified, all of which reduce urgency for most deployments. The primary real-world risk is insider threat or post-compromise lateral movement by an attacker who has already obtained privileged gateway credentials.

An attacker who has obtained privileged credentials to the IBM DataPower Gateway management interface submits a crafted XML document containing a DOCTYPE declaration that references an external entity pointing to a sensitive local file path (e.g., SYSTEM 'file:///etc/passwd') or a deeply nested recursive entity definition. The gateway's XML parser resolves the reference, either returning file contents in an error message or API response, or consuming sufficient heap memory to cause a service disruption affecting downstream API consumers.