What is the CVSS score of CVE-2026-16161?

CVE-2026-16161 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-16161?

Patch available per vendor advisory. Within 24 hours, inventory all IBM DataPower Gateway instances and determine which are running affected firmware streams: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; restrict network access to the gateway data and management interfaces where operationally feasible, enable and review availability and error logging for crash or resource-exhaustion indicators, and apply the vendor patch if an approved maintenance window is immediately available. Within 7 days, apply the vendor patch per IBM's advisory by upgrading each affected instance to the vendor-patched firmware release for its corresponding stream, confirm the new version after upgrade, and test gateway availability and dependent integrations; if patching must be staged, prioritize internet-facing and partner-connected instances first. Within 30 days, verify that no instances remain on the listed affected firmware ranges, complete patching for any remaining systems, and review network access controls and monitoring to ensure ongoing protection against unauthenticated remote availability attacks.

IBM DataPower Gateway CVE-2026-16161

EUVD-2026-94966 HIGH

Out-of-bounds Read (CWE-125)

2026-10-08 ibm

GHSA-xg53-qqv9-r75w

Buffer Overflow Denial Of Service Information Disclosure IBM Datapower Gateway 10 6Cd Datapower Gateway 10 5 0 Datapower Gateway 10 6 0 Datapower Gateway 11 0 0

7.5

CVSS 3.1 · Vendor: ibm

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach network-exposed DataPower Gateway
Exploit

Send crafted malformed request
Execution

Trigger out-of-bounds read (CWE-125)
Impact

Crash gateway, denial of service

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special configuration prerequisites are stated in the description - exploitation requires only network reachability to an affected IBM DataPower Gateway (versions 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, or 11.0.0.0-11.0.0.2) and the ability to send a crafted request that triggers the out-of-bounds read. The primary limiting factor is exposure: DataPower is typically deployed as an edge/integration gateway, so impact depends on whether the vulnerable interface is reachable by the attacker (internet-facing vs. internal-only), and the maximum outcome is service disruption rather than compromise. Applying the vendor patch removes the condition.
Impact	This is a genuine availability risk but not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, which is why it scores 7.5 HIGH - but the impact is strictly availability (C:N/I:N/A:H), so this is a denial-of-service flaw only, not a path to code execution or data theft. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of exploitation signals, combined with an impact ceiling of service disruption on an edge gateway, means this ranks below KEV-listed or RCE-class issues; prioritize patching for internet-facing DataPower instances where uptime is critical, but it is not a drop-everything event. Note a tag/impact tension: the input carries an 'Information Disclosure' tag, yet the CVSS vector sets C:N - an out-of-bounds read (CWE-125) can in principle leak memory, but both the description and the official vector describe only a crash/DoS, so treat information disclosure as unconfirmed and verify with the IBM advisory if confidentiality matters to your assessment.
Exploit ScenarioDerived	A remote attacker sends a specially crafted request across the network to an exposed DataPower Gateway instance, triggering an out-of-bounds read in the affected processing path. The read fault crashes or destabilizes the gateway, interrupting API and integration traffic that transits the appliance. No authentication or user interaction is required, but no public exploit code is known at this time.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 08, 2026

IBM DataPower Gateway is vulnerable to a remote, unauthenticated denial of service (CVSS 3.1 base 7.5) in which a crafted request triggers an out-of-bounds read, degrading or crashing the affected gateway service. All supported firmware streams in the affected ranges are exposed: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6 (the 10.6 CD stream), and 11.0.0.0 through 11.0.0.2. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms exploitable over the network with no authentication, privileges, or user interaction, but restricts impact to availability - no confidentiality or integrity loss is assessed - so exploitation results in service disruption rather than compromise; there is no public exploit identified at time of analysis, and a vendor patch is available.

RemediationAI

Apply the vendor-supplied fix for your firmware branch as documented in IBM's advisory at https://www.ibm.com/support/pages/node/7289775 - patch availability is confirmed by the vendor, but the exact fixed build numbers are published there per stream (10.5.0.x, 10.6.0.x, the 10.6.1-10.6.6 continuous-delivery line, and 11.0.0.x) and should be read directly from the advisory rather than assumed. If immediate upgrade is not possible, reduce exposure by restricting which interfaces can reach the vulnerable request-processing paths: place the gateway behind an upstream WAF or reverse proxy that can rate-limit and filter malformed requests (partial mitigation only, since the flaw is in parsing logic upstream filters may not normalize identically), and ensure management interfaces are never internet-facing. Because exploitation is a memory fault rather than credential abuse, no configuration toggle or authentication control fully removes the condition, and restarting the gateway after a crash restores service only until the next crafted request. The residual risk of delay is availability loss on an edge gateway, which can cascade to dependent API clients, so scheduling the vendor firmware update is the primary and durable fix.

Affected VersionsENISA

DataPower Gateway 10.6CD 10.6.1 ≤10.6.6

DataPower Gateway 11.0.0 11.0.0.0 ≤11.0.0.2

DataPower Gateway 10.5.0 10.5.0.0 ≤10.5.0.22

DataPower Gateway 10.6.0 10.6.0.0 ≤10.6.0.10

Affected Packages

euvd datapower_gateway_10_5_0 no fix

euvd datapower_gateway_10_6_0 no fix

euvd datapower_gateway_10_6cd no fix

euvd datapower_gateway_11_0_0 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is an out-of-bounds read (CWE-125) in IBM DataPower Gateway's request-handling code, a memory-safety class in which the parser or handler reads past the end of an allocated buffer when processing malformed or unexpected input. Because the read is out of bounds but the assessed vector assigns C:N, the practical effect is a fault or crash of the affected process rather than disclosure of memory contents to the attacker - the vendor's tagging includes Information Disclosure as a category, but the authoritative CVSS assessment scores no confidentiality impact, and the maximum realistic outcome is service disruption. CPE data identifies four distinct affected firmware lines (datapower_gateway_10.5.0, datapower_gateway_10.6.0, datapower_gateway_10.6cd covering the 10.6.1-10.6.6 continuous-delivery releases, and datapower_gateway_11.0.0), reflecting IBM's multi-branch release model for the DataPower appliance. DataPower is typically deployed as an edge security/integration gateway fronting APIs, XML/JSON transformations, and multi-protocol mediation, so any interface that parses attacker-supplied requests - including internet-facing API or web endpoints - is the relevant attack surface, while management and internal-only interfaces are lower risk because they are not network-reachable by untrusted parties.

Know when Datapower Gateway 10 6Cd gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (ibm) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Remote unauthenticated crafted request with no interaction yields AV:N/AC:L/PR:N/UI:N; out-of-bounds read causes only a crash, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

Executive ViewAI

Why It Matters

IBM DataPower Gateway is affected by a high-severity unauthenticated denial-of-service issue that can degrade or crash gateway services, potentially disrupting API, integration, and partner-facing traffic that depends on the appliance. With affected firmware spanning multiple supported streams and no public exploit identified at time of analysis, leadership should treat this as an availability risk requiring timely patching and exposure management rather than a data-breach scenario. Unpatched, externally reachable instances could cause operational downtime and customer impact.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.3%

Top 78% exploitable

Prevalence

Medium

enterprise API/integration gateway appliance, significant but not universal footprint

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.