EUVD-2026-94991
GHSA-3jq7-c3hf-9982
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Remote unauthenticated XML parsing (AV:N/AC:L/PR:N/UI:N); classic XXE yields data disclosure (C:H) and only memory-based degradation (A:L), with no integrity impact (I:N).
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
AnalysisAI
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 lets remote, unauthenticated attackers who can reach an XML-accepting endpoint read files or internal resources from the gateway host and, via entity expansion, exhaust memory. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) confirms no credentials or user interaction are required, with high confidentiality impact and low availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the targeted DataPower Gateway process attacker-supplied XML - i.e., a service/processing policy (such as an XML firewall, Web Service Proxy, or multiprotocol gateway handling SOAP/XML payloads) that accepts and parses XML from an untrusted source without external-entity resolution disabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible but moderate-priority issue rather than a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - update to the fixed DataPower firmware release identified in IBM's advisory at https://www.ibm.com/support/pages/node/7289775 for your respective 10.5.0, 10.6.0, 10.6.x (CD), or 11.0.0 branch; exact fixed build numbers should be taken from that advisory rather than assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM DataPower Gateway instances and determine which fall in the affected ranges (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2), then restrict external reachability of XML-accepting endpoints to known trusted sources as a temporary measure; note that no vendor fix version string was supplied in the advisory context, so obtain the precise fixed build from IBM's support portal rather than assuming the latest maintenance level is sufficient. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Datapower Gateway 10 6Cd
View allUnauthenticated remote code execution in IBM DataPower Gateway affects the 10.5.0.0 through 10.5.0.22, 10.6.0.0 through
Empty-password LDAP authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers obtain adminis
A remotely reachable, unauthenticated out-of-bounds write (buffer overflow, CWE-787) in IBM DataPower Gateway can corrup
Arbitrary code execution in IBM DataPower Gateway is possible when a user with existing local access to the appliance su
Unauthenticated remote code execution affects IBM DataPower Gateway across multiple release streams - 10.5.0.0 through 1
Out-of-bounds write in IBM DataPower Gateway lets unauthenticated remote attackers corrupt process memory, resulting in
An out-of-bounds write in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through
Unauthenticated remote attackers can trigger a memory-safety fault in IBM DataPower Gateway that crashes the affected se
Heap-based buffer overflow (CWE-787) in IBM DataPower Gateway allows an unauthenticated remote attacker to crash the gat
Security-restriction bypass in IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 thro
Remote code execution in IBM DataPower Gateway (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0
Out-of-bounds write in IBM DataPower Gateway lets a remote, unauthenticated attacker corrupt memory and potentially exec
Share
External POC / Exploit Code
Leaving vuln.today