EUVD-2026-94893
GHSA-v2xg-vfgx-6mfq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DataPower network interface
-
DeliverySend crafted/excessive requests
-
ExploitTrigger uncontrolled resource consumption
-
ExecutionExhaust CPU/memory/connections
-
ImpactGateway denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The DataPower Gateway must be running an affected firmware release (11.0.0.0 through 11.0.0.2) and must be reachable over the network by the attacker; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special privileges are required, implying default service exposure is sufficient. The IBM advisory does not specify a required non-default feature or configuration in the available description, so the concrete triggering mechanism (which service/protocol handler consumes resources) is not confirmed from the provided data. Limiting factors: impact is confined to availability (A:H only - no data exposure or code execution), and exposure is reduced where DataPower management/traffic interfaces are segmented, rate-limited, or not internet-facing. |
| Impact | This is a genuine but bounded availability risk rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 HIGH and indicates a remote, low-complexity, unauthenticated path to a pure availability impact (CWE-400, uncontrolled resource consumption) - no confidentiality or integrity loss. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponized code. The signals are internally consistent: a high-CVSS DoS reported through IBM PSIRT with a network/unauthenticated vector but impact limited to A:H. The realistic priority is moderate - patch promptly for internet-facing or high-availability DataPower deployments, but this is a service-disruption issue, not a data-breach or RCE condition. Missing data to note explicitly: EPSS probability is absent, and the IBM support page was not retrievable in this analysis, so exact triggering mechanism and fixed version are not independently confirmed here. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted or high-volume traffic to an internet- or network-reachable IBM DataPower Gateway (11.0.0.0-11.0.0.2), triggering uncontrolled resource consumption (CPU, memory, or connections) that exhausts the appliance and degrades or halts the API/integration traffic it fronts. No public exploit code has been identified at time of analysis, and the attack requires only network access with low complexity and no authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Unauthenticated remote attackers can exhaust system resources on IBM DataPower Gateway firmware releases 11.0.0.0 through 11.0.0.2, degrading or halting availability of the gateway's traffic and management services. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, user interaction, or special positioning are required once the affected interface is reachable, but impact is confined to availability - there is no data disclosure, tampering, or code execution component. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); the practical risk is therefore a bounded denial-of-service exposure that is highest where DataPower interfaces are internet-facing or unsegmented, and much lower where they sit behind network controls and rate limiting.
RemediationAI
No vendor-released patch version is identified in the provided data; IBM's advisory at https://www.ibm.com/support/pages/node/7289798 is the authoritative source for the fixed firmware release, so the primary action is to apply the first firmware level beyond 11.0.0.2 (or an IBM-supplied interim fix for the 11.0.0.x line) and confirm the deployed build no longer falls in the 11.0.0.0-11.0.0.2 range. Until that upgrade is completed, the most effective compensating controls are network-side: place DataPower management and traffic interfaces behind segmentation, allow-list only known-good client sources, and front externally reachable services with a rate-limiting reverse proxy or WAF configured for connection, request-size, and request-rate caps - the trade-off being that aggressive thresholds can throttle legitimate high-volume API or file-transfer traffic and must be tuned against normal baselines. Disable or block protocol handlers, API endpoints, and ancillary services (for example unused MQ, FTP/S, or administrative interfaces) that are not required for the deployment, at the cost of losing those integration paths; restrict management access to a dedicated out-of-band network or jump host; and enable resource-utilization monitoring with alerting on CPU, memory, connection-count, and disk thresholds so an attempted exhaustion can be detected and the affected service recycled before full outage. Because the concrete triggering mechanism is not confirmed in the available data, monitor vendor updates to the advisory for any newly documented configuration-based workarounds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM DataPower Gateway is a multi-protocol security and integration appliance (XML/SOAP/REST gateway, API gateway, MQ and file transfer front end) delivered as firmware images for physical and virtual deployments. This issue is classified as CWE-400, Uncontrolled Resource Consumption, a class in which a service handler accepts or processes attacker-controlled input without adequate bounds - for example unbounded request body sizes, excessive concurrent connection or session creation, recursion/expansion of parsed documents, or unbounded queue/log growth - until CPU, memory, connection table, or disk capacity is exhausted and legitimate traffic can no longer be served. The flaw was reported by IBM's own PSIRT (psirt@us.ibm.com) and affects the 11.0.0.x firmware line; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a network-reachable, low-complexity, unauthenticated trigger with high availability impact, while the scope-unchanged and confidentiality/integrity-none metrics indicate the resource exhaustion stays within the impacted appliance rather than affecting other components. The provided advisory does not identify which specific protocol handler, API endpoint, or configuration is required to trigger the consumption, so the exact resource (CPU, memory, sockets, or disk) cannot be confirmed from available data.
Know when Datapower Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, low-complexity, unauthenticated resource-exhaustion DoS with no privilege or interaction need; impact is availability-only, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
Executive ViewAI
IBM DataPower Gateway firmware versions 11.0.0.0 through 11.0.0.2 are affected by a high-severity unauthenticated denial-of-service vulnerability that can exhaust resources and disrupt traffic and management services. This creates a risk of service outages for organizations that rely on these gateways for critical integration and API functions, particularly where interfaces are internet-facing. There is no public exploit identified at time of analysis, but leadership should prioritize assessing exposure and implementing interim mitigations to maintain availability.
Network segmentation, access controls, rate limiting, and resource monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Datapower Gateway
View allRemote, unauthenticated code execution is possible in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account tha
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21
IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attac
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attac
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15
A heap buffer overflow in IBM DataPower Gateway (affected firmware levels 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 1
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or degrade an affected gat
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or exhaust the message-pro
A heap buffer underwrite in IBM DataPower Gateway allows unauthenticated remote attackers to crash the gateway service,
Exploit-DB