EUVD-2026-94892
GHSA-2gg7-vwqc-2jg2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed DataPower network endpoint
-
DeliverySend crafted malformed request
-
ExploitTrigger heap buffer overflow in parser
-
ExecutionCorrupt heap memory
-
ImpactCrash gateway, denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to an IBM DataPower Gateway running an affected firmware level (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, or 11.0.0.0-11.0.0.2); per the CVSS vector no authentication, privileges, or user interaction are needed. The practical limiting factor is exposure: gateways restricted to internal or management networks sharply reduce reachable attack surface, and the impact is confined to availability (service crash) - there is no confidentiality or integrity compromise and no code execution. No non-default feature toggle is named in the description, so default-configured affected versions appear exploitable once network access exists. |
| Impact | This is a genuine availability risk but not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, and the A:H/C:N/I:N profile means the only impact is denial of service - consistent with the description of a heap buffer overflow (CWE-787) crashing the gateway. There is no CISA KEV listing, no public exploit code identified, and no EPSS score was supplied in the input, so there is no evidence of active or at-scale exploitation; the 7.5 score is driven entirely by the ease of remote triggering, not by data loss or code execution. The signals are internally consistent (network DoS, no confidentiality/integrity impact), so no contradiction needs flagging; the main caveat is that exploitation likelihood cannot be independently quantified because EPSS is absent. Treat as a priority patch for internet-facing or high-availability DataPower deployments, but below any flaw offering code execution or data exposure. |
| Exploit ScenarioDerived | A remote attacker sends specially crafted traffic to an exposed IBM DataPower Gateway endpoint, triggering a heap buffer overflow that corrupts memory and crashes the gateway process, interrupting API/traffic processing for all clients behind it. No authentication or user interaction is required per the CVSS vector. No public exploit code has been identified at time of analysis, so weaponization would require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A heap buffer overflow in IBM DataPower Gateway (affected firmware levels 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows remote attackers to crash the service and cause a denial of service; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, privileges, or user interaction are required, so any reachable affected gateway is a candidate target. Impact is confined to availability - the vendor reports no confidentiality or integrity loss and no code execution. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); this is a genuine availability risk but not a top-tier emergency, with practical exposure limited by how broadly the gateway's data-plane and management interfaces are reachable.
RemediationAI
No vendor-released patch identifier is stated in the available input data, so treat patch status as unconfirmed and consult the IBM support advisory at https://www.ibm.com/support/pages/node/7289775 for the exact fixed firmware levels and upgrade path covering the 10.5.x, 10.6.0.x, 10.6.1.x, and 11.0.x trains, and apply the vendor-designated fix release as soon as it is available. Until a fixed firmware level is deployed, reduce reachable surface: restrict the network-facing data-plane and management interfaces to trusted source ranges with firewall/ACL rules or place the gateway behind a proxy that only forwards expected request shapes - the trade-off is that this can block legitimate external API consumers and requires accurate client-IP inventory. Disable or unbind unused service endpoints and protocols in the affected firmware; the trade-off is loss of functionality for any dependent integration. Monitor the appliance for unexpected process restarts, service crashes, or OOM-style aborts, which are the observable symptom of a successful heap-corruption trigger, and rate-limit or alert on anomalous request bursts to exposed listeners. Note that upgrading is disruptive for an appliance handling live traffic, so schedule it in a maintenance window with a tested fallback image.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM DataPower Gateway is a hardened multi-protocol security and integration appliance (XML/SOAP/REST gateway, API management, and message-processing firmware) that terminates and inspects network traffic on behalf of back-end services. The defect is classified as CWE-787, Out-of-bounds Write, and the vendor describes it as a heap buffer overflow: a parsing or message-processing path writes past the end of a heap-allocated buffer, corrupting adjacent heap metadata/allocation state rather than yielding a controlled code-execution primitive. That root-cause class typically produces memory corruption that manifests as an abnormal process or service termination, which matches the published impact of C:N/I:N/A:H - availability only. Because the flaw lives in shared request-handling code, the attack surface is the network-facing service port of the gateway rather than a local utility; the vulnerable ranges span four firmware trains (10.5.x, 10.6.0.x, 10.6.1.x, and 11.0.x), indicating the same underlying code was carried forward across releases. No CPE strings were supplied in the available data, so exact platform/edition mappings should be taken from IBM's advisory rather than inferred.
Know when Datapower Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated low-complexity trigger (AV:N/AC:L/PR:N/UI:N) with crash-only impact, so C:N/I:N but A:H and unchanged scope.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
Executive ViewAI
IBM DataPower Gateway, a critical integration and API gateway, contains an unauthenticated remote denial-of-service vulnerability (CVE-2026-16170) that can crash the service and disrupt dependent applications. Until IBM releases a fix, any reachable gateway in the affected firmware ranges poses a direct availability risk to customer-facing APIs and internal integrations. Leadership should prioritize identifying and isolating exposed instances to prevent service outages that could impact business operations and customer trust.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to management and data-plane interfaces, applying rate limiting and connection throttling, deploying WAF rules to block malformed traffic, segmenting gateways, and ensuring redundancy and failover capabilities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Datapower Gateway
View allRemote, unauthenticated code execution is possible in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account tha
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21
IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attac
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attac
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or degrade an affected gat
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or exhaust the message-pro
Unauthenticated remote attackers can exhaust system resources on IBM DataPower Gateway firmware releases 11.0.0.0 throug
A heap buffer underwrite in IBM DataPower Gateway allows unauthenticated remote attackers to crash the gateway service,
Exploit-DB