IBM DataPower Gateway CVE-2026-15781

Requires an authenticated attacker holding high/administrative privileges (PR:H) on the IBM DataPower Gateway reachable over the network, who can supply crafted input that triggers a stack-based buffer overflow (CWE-121). Exploitation is further limited by High attack complexity (AC:H), indicating dependence on conditions the attacker cannot fully control - e.g. specific memory layout, timing, or input-parsing state - rather than a deterministic single-shot trigger. Limited to the enumerated firmware versions: 10.5.0.0-10.5.0.22, 10.6.1-10.6.6, 10.6.0.0-10.6.0.10, and 11.0.0.0-11.0.0.2; patched builds are not affected. The high privilege requirement means only accounts already trusted to administer the gateway can exploit it.

This is a genuinely serious but meaningfully gated vulnerability. The IBM-provided CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, 8.0 High) describes remote, network-reachable arbitrary code execution with full confidentiality, integrity, and availability impact - but it is constrained by two important factors: PR:H (the attacker must already hold high/administrative privileges) and AC:H (exploitation depends on conditions outside the attacker's direct control, consistent with a buffer-overflow race or specific memory-layout requirement). No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are therefore consistent rather than conflicting: high technical impact but a high privilege barrier and high attack complexity. This is a legitimate patch-soon priority for organizations running the affected DataPower firmware - especially given its role as a security/API gateway - but it is not a drop-everything emergency in the mold of an unauthenticated, wormable flaw. The PR:H requirement means the realistic threat is a malicious or compromised privileged operator, or an attacker who has already escalated, rather than mass opportunistic exploitation. Note: the description says 'remote authenticated attacker' without specifying privilege level, while the vector asserts PR:H - verify the exact required privilege tier with IBM advisory node 7289775 before deprioritizing.

An attacker who has obtained authenticated administrative access to an affected IBM DataPower Gateway (versions in the 10.5.0.x, 10.6.0.x, 10.6.1-10.6.6, or 11.0.0.x ranges) submits crafted input that overflows a stack buffer (CWE-121) in the gateway, corrupting the stack to redirect execution. Because the attack complexity is High, reliable exploitation likely requires meeting specific timing or memory-layout conditions. No public exploit code was identified at time of analysis.