IBM DataPower Gateway CVE-2026-16178

Exploitation requires network reachability to an affected IBM DataPower Gateway instance (versions 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, or 11.0.0.0-11.0.0.2) exposing the vulnerable service that performs the improper input validation; the attacker sends crafted/malformed input that is not properly validated. Per CVSS PR:N/UI:N it needs no authentication and no user interaction. The primary limiting factor is exposure: the impact is availability-only (service crash/DoS), so risk is concentrated on gateways whose vulnerable interface is reachable by untrusted networks, and it is mitigated by upgrading to a fixed IBM release.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with impact restricted entirely to availability - no confidentiality or integrity loss. That profile makes it a service-disruption issue, not a code-execution or data-breach issue, despite the 'Buffer Overflow' and 'Memory Corruption' tags and the CWE-787 (out-of-bounds write) classification, which would normally suggest potential for code execution; the vendor-scored impact (C:N/I:N) indicates the condition manifests only as a crash/DoS. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from the input - status is 'no public exploit identified at time of analysis.' Because DataPower is typically an internet- or partner-facing gateway, an unauthenticated network DoS against a security/integration chokepoint is operationally meaningful and should be patched on a normal-to-elevated schedule, but there is no evidence of active or imminent widespread exploitation. Note the signal tension to verify with IBM: memory-corruption/CWE-787 indicators vs. availability-only scored impact - confirm whether the condition is strictly a crash or could be escalated.

A remote, unauthenticated attacker sends a specially crafted request to a network-exposed IBM DataPower Gateway service that is improperly validated, triggering an out-of-bounds write that crashes or hangs the gateway and interrupts the traffic it brokers. Because no authentication or user interaction is required and complexity is low, the request can be repeated to sustain the outage. No public exploit code is identified in the provided data.