IBM DataPower Gateway EUVD-2026-94961

No special configuration condition is stated in the description - the flaw is reachable by a remote attacker over the network against affected DataPower Gateway versions (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2) consistent with AV:N/AC:L/PR:N/UI:N. The primary limiting factor is network exposure: exploitation requires the attacker to be able to send traffic to the gateway's listening service, so devices restricted to trusted/internal networks face lower real-world risk than internet-facing deployments. The specific input or protocol path that triggers the improper bounds check is not disclosed, and only the enumerated version ranges are affected - gateways already updated to fixed releases are not vulnerable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw with no user interaction, impacting availability only - confidentiality and integrity are explicitly N, consistent with a denial-of-service outcome rather than code execution, despite the CWE-787 (out-of-bounds write) classification. The CWE-787 label combined with 'improper bounds checking' and the Memory Corruption/Buffer Overflow tags raises the theoretical possibility of memory-corruption-driven impact, but IBM scoped the impact strictly to availability (A:H, C:N, I:N), so the realistic worst case is a gateway crash/service outage, not RCE - this is a signal worth noting as potentially conservative but it is the vendor's own assessment. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no proof-of-concept or public exploit is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Net: a genuine, remotely exploitable availability risk on an internet-facing security appliance that warrants prompt patching, but with no current evidence of active exploitation or public exploit code, it is a high-severity-by-score issue without confirmed real-world weaponization. If EPSS data becomes available it should be cross-checked, as it is currently missing.

A remote, unauthenticated attacker sends a crafted request or malformed input across the network to an internet-facing IBM DataPower Gateway, triggering the improper bounds check and causing an out-of-bounds write that crashes or hangs the gateway service. Because the device typically fronts APIs and backend services, the outage cascades to all traffic it proxies. No public proof-of-concept or exploit code is referenced in the available data.