IBM DataPower Gateway CVE-2026-16164

The attacker needs network reachability to a listening DataPower Gateway service and the ability to send crafted input that reaches the vulnerable parser; per CVSS PR:N/UI:N no authentication or user interaction is required. The description does not name the exact protocol, service handler, or configuration mode that processes the malformed input, so the precise triggering surface is not confirmed from available data. Limiting factors: impact is availability-only (A:H, C:N/I:N) - a crash/DoS, not data compromise or code execution - and exposure depends on whether the gateway's affected listener is reachable from the attacker's network position (edge-facing deployments are most exposed). Only the enumerated versions (10.5.0.0-10.5.0.22, 10.6.1-10.6.6, 10.6.0.0-10.6.0.10, 11.0.0.0-11.0.0.2) are affected; patched builds remove the condition.

This is a genuine but bounded operational concern rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a remotely reachable, low-complexity, unauthenticated flaw with impact confined entirely to availability - no confidentiality or integrity loss - consistent with CWE-787 (out-of-bounds write) producing a crash/DoS rather than code execution. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' The only signals pulling risk upward are the network attack vector, lack of required privileges, and the fact that DataPower often sits at the network edge handling untrusted traffic; the signals pulling it down are the availability-only impact and absence of any exploitation/POC intelligence. Note a potential tension to verify: CWE-787 (out-of-bounds write) can sometimes imply memory-corruption that leads to code execution, yet the CVSS impact is scoped as A:H only (C:N/I:N) - confirm with IBM whether the overflow is strictly a DoS or carries latent RCE potential. Net: patch on a normal-to-expedited cycle given a vendor fix exists, but this is not a drop-everything issue absent exploitation evidence.

A remote, unauthenticated attacker sends specially crafted traffic to an internet- or network-reachable DataPower Gateway, triggering an out-of-bounds write that corrupts memory and crashes the gateway process, interrupting all API/message traffic transiting the appliance. No public exploit code is identified at time of analysis, and the impact is service disruption rather than data theft or code execution per the CVSS vector.