IBM DataPower Gateway EUVD-2026-51259

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network access to an affected IBM DataPower Gateway listener - remote, unauthenticated, low-complexity triggering against reachable instances. The primary limiting factor is reachability: the impact is confined to availability (A:H, C:N/I:N), so exploitation degrades or halts the gateway but does not yield data access or code execution, and instances shielded behind network restrictions or upstream rate-limiting are substantially harder to disrupt. The provided data does not name a specific feature, protocol handler, or non-default configuration as a prerequisite, so a precise triggering vector should be confirmed against IBM bulletin node/7278746.

The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an easily reachable, unauthenticated, low-complexity network attack, which supports treating this as a genuine availability concern for internet- or partner-facing gateways. However, impact is limited to availability (C:N/I:N/A:H) - there is no data disclosure or code execution - so this is a service-disruption risk, not a compromise. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation-probability signals are absent rather than low; the score is therefore an inherent-severity estimate, not an evidence-of-exploitation one. Because DataPower frequently sits inline as a critical API/security enforcement point, a successful DoS can have outsized operational impact even though the technical impact class is 'only' availability. Net priority: patch promptly on externally exposed instances, but no indication of active or imminent widespread exploitation.

A remote attacker with network reach to an exposed DataPower listener sends a stream of specially crafted or high-volume requests that each cause the gateway to allocate resources without an enforced limit. As allocations accumulate faster than they are freed, the appliance exhausts memory or connection capacity and stops servicing legitimate API traffic. No authentication or user interaction is required (PR:N/UI:N), and no public exploit is identified at time of analysis.