EUVD-2026-94969
GHSA-27r3-8555-4mqr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DataPower network service
-
DeliverySend crafted malformed request
-
ExploitTrigger type confusion (CWE-843)
-
ExecutionCrash or hang gateway process
-
ImpactDenial of service for fronted traffic
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a remote, unauthenticated attacker can trigger the type confusion by sending crafted input to a reachable DataPower Gateway service. Exploitation is limited to the specific affected build ranges (10.5.0.0-10.5.0.22, 10.6.1-10.6.6, 10.6.0.0-10.6.0.10, 11.0.0.0-11.0.0.2) and requires network access to the gateway's listening interface; impact is confined to availability (service crash/DoS) with no confidentiality or integrity effect, and a vendor patch is available to eliminate the condition. |
| Impact | The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent and describes a remotely reachable, low-complexity, unauthenticated flaw whose sole impact is availability (C:N/I:N/A:H) - a pure denial-of-service, matching CWE-843 (type confusion) and the description. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public exploit is referenced, so exploitation likelihood cannot be quantified from the input; the only mitigating signal is that a vendor patch is available. The exploitability metrics look severe (network, no auth, no user interaction), but the impact ceiling is capped: there is no confidentiality or integrity loss and no code execution, so this is a service-disruption risk rather than a compromise risk. Net assessment: a credible but bounded priority - patch promptly on internet-facing or high-availability DataPower deployments, but it does not carry the lateral-movement or data-breach weight its 7.5 score might suggest. EPSS is absent (not low - simply not provided), so do not read the missing probability as evidence of low real-world interest. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted input to an affected IBM DataPower Gateway over the network, triggering the type confusion flaw and crashing or hanging the gateway, interrupting all API/traffic processing it fronts. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N). No public proof-of-concept exploit is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A type confusion flaw (CWE-843) in IBM DataPower Gateway lets a remote, unauthenticated attacker crash a reachable gateway service, producing a denial-of-service condition. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a network-reachable, low-complexity, unauthenticated trigger with availability-only impact. IBM has published a vendor fix via its support advisory, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
RemediationAI
IBM has released a vendor fix for this issue; apply the IBM-provided firmware update for your affected release stream as documented in the advisory at https://www.ibm.com/support/pages/node/7289775, which specifies the corrected level for each of the 10.5.0.x, 10.6.0.x, 10.6.x CD, and 11.0.0.x lines (the input data confirms patch availability from the vendor but does not enumerate the exact corrected build numbers, so consult the advisory rather than assuming a version). Until the update can be staged, reduce exposure by restricting network access to DataPower service interfaces to trusted source addresses via firewall ACLs or interface binding - accepting that this may break legitimate client traffic and does not fix the underlying type confusion - and by fronting the gateway with a reverse proxy or filtering layer that rejects malformed or unexpected payload shapes, with the trade-off of added latency and possible false positives on legitimate requests. Monitor for repeated process terminations, crash loops, or availability gaps on the gateway, since successful exploitation presents as service interruption rather than data compromise; no public exploit code has been identified at time of analysis, so there is no known signature to prioritize beyond these controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-843, Type Confusion, a memory-safety class in which the product allocates or casts an object as one type but later accesses it as an incompatible type, so field and vtable offsets are interpreted against the wrong layout. In DataPower Gateway the flaw manifests as memory corruption (per the associated tags) inside a service that parses externally supplied input over the network, so a crafted request can drive execution into an invalid state and terminate the affected process. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the vulnerable path is exposed on a listening interface, requires no credentials or user interaction, and yields only loss of availability - there is no demonstrated confidentiality or integrity impact and no scope change. The CPE data enumerates the affected streams as ibm:datapower_gateway_10.5.0, ibm:datapower_gateway_10.6.0, ibm:datapower_gateway_10.6cd, and ibm:datapower_gateway_11.0.0, matching the version ranges in the description across the 10.5, 10.6, 10.6 CD, and 11.0 firmware lines.
Know when Datapower Gateway 10 6Cd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable gateway service exploitable without authentication or interaction (AV:N/AC:L/PR:N/UI:N); type confusion yields only denial of service, so C:N/I:N/A:H.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.
Executive ViewAI
IBM DataPower Gateway, a core integration and API gateway platform used to broker traffic between critical internal and external systems, contains a type confusion defect that allows any network-reachable party to crash an exposed gateway service without credentials. Because the impact is availability-only, the exposure is disruption of dependent applications and transaction flows rather than data theft, but a successful trigger can interrupt API traffic and customer-facing or partner-facing services. Organizations running affected 10.5, 10.6, or 11.0 builds should treat this as an operational continuity issue with a vendor remediation path already available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Datapower Gateway 10 6Cd
View allUnauthenticated remote code execution affects IBM DataPower Gateway across multiple release streams - 10.5.0.0 through 1
Unauthenticated remote code execution in IBM DataPower Gateway affects the 10.5.0.0 through 10.5.0.22, 10.6.0.0 through
Arbitrary code execution in IBM DataPower Gateway is possible when a user with existing local access to the appliance su
Empty-password LDAP authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers obtain adminis
Remote code execution in IBM DataPower Gateway (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0
A remotely reachable, unauthenticated out-of-bounds write (buffer overflow, CWE-787) in IBM DataPower Gateway can corrup
IBM DataPower Gateway versions 10.5.0.0-10.5.0.20, 10.6.0.0-10.6.0.8, and 10.6.1.0-10.6.5.0 are vulnerable to cross-site
Out-of-bounds write in IBM DataPower Gateway lets unauthenticated remote attackers corrupt process memory, resulting in
An out-of-bounds write in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0
Heap-based buffer overflow (CWE-787) in IBM DataPower Gateway allows an unauthenticated remote attacker to crash the gat
Unauthenticated remote attackers can trigger a memory-safety fault in IBM DataPower Gateway that crashes the affected se
Exploit-DB