EUVD-2026-94992
GHSA-xxwv-h449-cv3p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated reach gives AV:N/PR:N/UI:N; heap-overflow RCE requires layout grooming/mitigation bypass so AC:H; code execution on the appliance yields full C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.
AnalysisAI
Remote code execution in IBM DataPower Gateway (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2) is possible via a heap-based buffer overflow, allowing an unauthenticated network attacker to corrupt memory and potentially execute arbitrary code. Exploitation requires high attack complexity (AC:H) due to the need for memory-layout grooming and likely ASLR bypass, but no authentication (PR:N) or user interaction (UI:N) is needed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The network-facing DataPower Gateway service must be reachable by the attacker, but no authentication (PR:N) and no user interaction (UI:N) are required, so default deployments exposing the gateway's processing endpoints are exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely serious flaw but with meaningful friction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory; IBM has released fixes for the affected DataPower Gateway versions, detailed at https://www.ibm.com/support/pages/node/7289775. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM DataPower Gateway instances and identify any running affected versions: 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, or 11.0.0.0-11.0.0.2; apply the vendor-released patch per IBM's advisory (Patch available per vendor advisory), and if immediate patching is not possible, restrict network access to trusted sources, enable detailed logging, and monitor for anomalous gateway behavior. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Datapower Gateway 10 6Cd
View allUnauthenticated remote code execution in IBM DataPower Gateway affects the 10.5.0.0 through 10.5.0.22, 10.6.0.0 through
Empty-password LDAP authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers obtain adminis
A remotely reachable, unauthenticated out-of-bounds write (buffer overflow, CWE-787) in IBM DataPower Gateway can corrup
Arbitrary code execution in IBM DataPower Gateway is possible when a user with existing local access to the appliance su
Unauthenticated remote code execution affects IBM DataPower Gateway across multiple release streams - 10.5.0.0 through 1
Out-of-bounds write in IBM DataPower Gateway lets unauthenticated remote attackers corrupt process memory, resulting in
An out-of-bounds write in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through
Unauthenticated remote attackers can trigger a memory-safety fault in IBM DataPower Gateway that crashes the affected se
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0
Heap-based buffer overflow (CWE-787) in IBM DataPower Gateway allows an unauthenticated remote attacker to crash the gat
Security-restriction bypass in IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 thro
Out-of-bounds write in IBM DataPower Gateway lets a remote, unauthenticated attacker corrupt memory and potentially exec
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today