IBM DataPower Gateway CVE-2026-16340

Exploitation requires that the DataPower Gateway process untrusted input through its RFC2047 encoded-word parser - i.e., a service/flow that decodes MIME-style encoded-word headers (such as email/MIME or message-header processing) must be reachable by the attacker. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity, so against an affected version (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, or 11.0.0.0-11.0.0.2) exposing such a flow, exploitation is remote and unauthenticated. The main limiting factor is version: deployments outside the listed ranges, or configurations that do not route attacker-controlled data through encoded-word decoding, reduce exposure. No special non-default toggle is named in the advisory, so a configuration-dependency cannot be confirmed from available data.

All provided scoring signals point to high severity: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N (base 9.8) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction and full confidentiality, integrity, and availability impact, consistent with CWE-787 (out-of-bounds write) leading to arbitrary code execution. However, several key risk signals are MISSING from the input and must not be assumed: there is no EPSS exploitation-probability score, no CISA KEV listing, no POC indicator, and no SSVC decision data provided. Per precision rules, exploitation status is therefore 'no public exploit identified at time of analysis' - this is NOT a zero-day or actively-exploited situation based on available data. The only reference is a single IBM support page (surfaced via NVD with no title), so independent corroboration of exploitability beyond the vendor's own PSIRT advisory is absent. Net: this is a genuinely high-priority patch candidate because of the unauthenticated network RCE profile on a security gateway appliance, but the real-world urgency ranking (versus other 9.8s) cannot be sharpened without EPSS/KEV/POC data, which is unavailable here.

A remote attacker sends a crafted message containing a malformed RFC2047 encoded-word (e.g., in a MIME header such as Subject or From processed by the gateway) that triggers an out-of-bounds write while the encoded-word parser decodes it. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required, and successful memory corruption can lead to arbitrary code execution on the DataPower appliance. No public proof-of-concept is identified in the provided data.