IBM DataPower Gateway EUVD-2026-94890

Per IBM's description, the attacker must be a REMOTE AUTHENTICATED user of the DataPower Gateway - i.e., possess valid credentials to reach the vulnerable request-handling interface - on versions 10.5.0.0-10.5.0.22, 10.6.1-10.6.6, 10.6.0.0-10.6.0.10, or 11.0.0.0-11.0.0.2. No specific feature toggle or non-default configuration is named in the description. The primary limiting factor is the authentication requirement stated by IBM (which directly contradicts the NVD vector's PR:N); combined with only low confidentiality impact and no integrity/availability effect, realistic risk is constrained to credentialed actors harvesting memory fragments rather than unauthenticated mass exploitation.

This is a moderate-severity information disclosure flaw (CWE-125 out-of-bounds read) with a CVSS base score of 5.3. The signals are largely consistent on impact but CONFLICT on privileges: the NVD CVSS vector (AV:N/AC:L/PR:N/UI:N) encodes an unauthenticated network attacker, yet the IBM-authored description explicitly states a 'remote authenticated attacker' - these cannot both be true, and the discrepancy materially changes exposure (internet-facing unauth vs. requiring a valid gateway credential). This should be verified against the IBM advisory (node/7289775); the description, coming from IBM PSIRT itself, is the more authoritative source and suggests PR:N in the NVD vector is likely an error. No EPSS score, KEV listing, or POC was provided, so exploitation probability cannot be quantified from the input; per available data this is 'no public exploit identified at time of analysis.' Impact is limited (C:L, I:N, A:N) - only partial confidentiality loss (adjacent memory such as process data, not guaranteed secrets), no integrity or availability effect. Net: a real but low-priority issue absent evidence of exploitation - patch in normal cycles unless the unauthenticated-vs-authenticated question resolves toward unauthenticated internet-facing exposure.

An attacker with access to the DataPower Gateway management or data plane (authentication required per IBM's description) sends a crafted request that causes the gateway to read beyond an allocated buffer, returning adjacent process memory in the response. Over repeated requests this could leak fragments of sensitive runtime data. No public exploit code was identified in the provided intelligence.