EUVD-2026-95001
GHSA-3558-f8gc-mcgw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to DataPower Gateway with low privileges
-
ExploitCraft forged signature request
-
ExecutionBypass improper data-authenticity verification
-
ImpactTamper with signed/trusted data integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | Exploitation requires an authenticated session on the IBM DataPower Gateway (CVSS PR:L), so the attacker must hold valid low-privilege credentials or an existing foothold on the appliance; it cannot be performed by an unauthenticated remote attacker. The specific trigger is submitting signature requests that the gateway processes with improper verification of data authenticity (CWE-345), enabling forgery. Affected deployments are limited to DataPower Gateway firmware 10.5.0.0-10.5.0.22, 10.6.1-10.6.6, 10.6.0.0-10.6.0.10, and 11.0.0.0-11.0.0.2; the authentication requirement and integrity-only impact (no data exposure or service disruption) are the key limiting factors for defenders. |
| Impact | This is a moderate-risk, authenticated integrity vulnerability rather than a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) confirms a network-reachable, low-complexity attack that requires low-privilege authentication (PR:L), with impact limited entirely to integrity (I:H) - no confidentiality (C:N) or availability (C:N/A:N) loss. No EPSS score, KEV listing, or POC was provided, and there is no public exploit identified at time of analysis, which argues against widespread opportunistic exploitation. The requirement for valid authentication (PR:L) meaningfully limits the attacker population to users who already have some access to the gateway, making this more relevant to insider-threat and post-compromise scenarios than to mass exploitation. A notable data conflict: the input Tags label this 'Information Disclosure,' but the CVSS vector sets C:N and the CWE is CWE-345 (improper verification of data authenticity), so the real impact is signature forgery / integrity, not disclosure - the tag appears mislabeled and should not drive triage. |
| Exploit ScenarioDerived | An authenticated low-privilege user of the DataPower Gateway submits a crafted signature request that the gateway fails to properly verify for data authenticity, allowing the user to forge signatures on data the gateway processes or signs. No public exploit code is known, and because valid authentication is required (PR:L), the attacker must already possess gateway credentials or a foothold. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Signature forgery in IBM DataPower Gateway lets an authenticated user with valid low-privilege credentials submit signature requests that the appliance processes without properly verifying data authenticity, producing forged signatures that relying parties may accept as genuine. Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; the impact is integrity-only (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with no confidentiality or availability loss. There is no public exploit identified at time of analysis, and IBM has published a vendor fix via its support portal, so this is a moderate-risk authenticated integrity issue rather than a remotely exploitable, unauthenticated critical defect.
RemediationAI
Patch available per vendor advisory: IBM documents the fix for these DataPower Gateway firmware branches at https://www.ibm.com/support/pages/node/7289775, and administrators should apply the corrected firmware build listed there for their specific branch (10.5.0, 10.6.0, 10.6CD, or 11.0.0) after validating the upgrade path and taking the usual configuration backup. Because exploitation requires an authenticated session, the highest-value compensating control is to restrict who can reach the signing service and management interfaces: place them behind administrative network segmentation or an allow-listed jump host and enforce strong authentication plus MFA on all DataPower accounts, accepting that this tightens operational access for legitimate automation. Reduce the blast radius by removing or downgrading unused low-privilege accounts and by disabling any signature or crypto service that is not actively needed, with the trade-off that dependent integrations must be re-pointed. Rotate signing keys and certificates issued or asserted by affected appliances, since previously forged signatures cannot be distinguished retroactively, and add an independent verification step at the consuming application rather than trusting the gateway's signature assertion alone, at the cost of extra processing and integration work. Until the fix is applied, log and alert on unusual signature-request volume or unexpected signer identities in DataPower audit logs as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-345, Insufficient Verification of Data Authenticity: DataPower Gateway's signing/signature-verification logic accepts signature requests without adequately validating the authenticity of the underlying data, so a caller who already holds a session can cause the gateway to emit signatures that do not correspond to trustworthy content. DataPower is an XML/JSON/SOAP security and integration gateway commonly used for message signing, WS-Security, encryption offload, and multi-protocol mediation, which means forged signatures can propagate into downstream trust decisions if consumers rely solely on the gateway's assertion. The vulnerability class is a trust-boundary failure in cryptographic validation rather than a memory-safety or injection flaw, and the CPE data (cpe:2.3:a:ibm:datapower_gateway_10.5.0, datapower_gateway_10.6.0, datapower_gateway_10.6cd, and datapower_gateway_11.0.0) confirms four firmware branches are in scope, including the 10.6CD continuous-delivery line. Exploitation requires network reachability to the gateway's management or service interfaces plus authenticated access at PR:L, which aligns with the assessed vector and rules out unauthenticated remote abuse.
Know when Datapower Gateway 10 6Cd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable gateway service (AV:N) exploitable with valid low-privilege credentials (PR:L) and no user interaction; impact is signature forgery affecting integrity only (I:H, C:N/A:N).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Datapower Gateway 10 6Cd
View allUnauthenticated remote code execution affects IBM DataPower Gateway across multiple release streams - 10.5.0.0 through 1
Unauthenticated remote code execution in IBM DataPower Gateway affects the 10.5.0.0 through 10.5.0.22, 10.6.0.0 through
Arbitrary code execution in IBM DataPower Gateway is possible when a user with existing local access to the appliance su
Empty-password LDAP authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers obtain adminis
Remote code execution in IBM DataPower Gateway (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0
A remotely reachable, unauthenticated out-of-bounds write (buffer overflow, CWE-787) in IBM DataPower Gateway can corrup
IBM DataPower Gateway versions 10.5.0.0-10.5.0.20, 10.6.0.0-10.6.0.8, and 10.6.1.0-10.6.5.0 are vulnerable to cross-site
Out-of-bounds write in IBM DataPower Gateway lets unauthenticated remote attackers corrupt process memory, resulting in
An out-of-bounds write in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0
Heap-based buffer overflow (CWE-787) in IBM DataPower Gateway allows an unauthenticated remote attacker to crash the gat
Unauthenticated remote attackers can trigger a memory-safety fault in IBM DataPower Gateway that crashes the affected se
Exploit-DB