IBM DataPower Gateway CVE-2026-16165

Exploitation requires network reachability to an affected DataPower Gateway instance running a vulnerable version (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, or 11.0.0.0-11.0.0.2) and the ability to deliver the triggering malformed request to a listening service interface. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or special timing is required. The principal limiting factors are therefore exposure and version: gateways not reachable from the attacker's network, or already patched per IBM node/7289775, are not exploitable, and impact is confined to availability (service crash/DoS) with no data exposure or code execution. The exact protocol/feature and malformed input that trigger the dereference are not specified in the available data.

This is a credible but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated condition with no confidentiality or integrity impact - consistent with the CWE-476 null pointer dereference denial of service in the description. All three impact signals point only to availability (A:H), so the ceiling here is service disruption, not compromise. Exploitation signals are weak-to-absent: no CISA KEV listing and no public proof-of-concept were provided, so this is no public exploit identified at time of analysis; no EPSS score or SSVC decision data was supplied, which limits any probabilistic ranking. A vendor patch is available (IBM support node 7289775) and IBM is the reporting party, which favors a coordinated, pre-exploitation disclosure rather than active in-the-wild abuse. Net: a genuine patch-worthy issue for exposed DataPower Gateways because it is unauthenticated and network-reachable, but it should be prioritized as an availability/hardening fix rather than a critical breach risk, and it ranks below any KEV-listed or code-execution flaw. Missing data to note explicitly: no EPSS and no SSVC inputs were provided, so real-world exploitation likelihood cannot be quantified from this data.

A remote, unauthenticated attacker sends a specially crafted request to a network-reachable DataPower Gateway interface that triggers a null pointer dereference in the processing logic, crashing the service or worker and denying service to legitimate API/integration traffic. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are needed, though the specific malformed input is not detailed in the available data. No public exploit code was identified at time of analysis.