EUVD-2026-94967
GHSA-w535-r5mv-2r4m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Vendor describes remote unauthenticated exploitation (AV:N/PR:N/UI:N/AC:L); OOB write yields partial info disclosure (C:L/I:L) and a crash (A:H), scope unchanged.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.
AnalysisAI
Out-of-bounds write in IBM DataPower Gateway lets unauthenticated remote attackers corrupt process memory, resulting in disclosure of sensitive information and denial of service. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with a CVSS 3.1 base score of 8.6 driven by high availability impact alongside limited confidentiality and integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions stated - the IBM advisory describes remote exploitation by an unauthenticated attacker (PR:N/UI:N) against affected IBM DataPower Gateway versions (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, 11.0.0.0-11.0.0.2), with no mention of a required non-default feature or configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible operational priority but not a confirmed emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: IBM has published remediation for CVE-2026-16159 at https://www.ibm.com/support/pages/node/7289775, which identifies the fixed DataPower Gateway build for each affected release line (10.5.0.x, 10.6.0.x, 10.6.1-10.6.6, and 11.0.0.x). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM DataPower Gateway instances and identify those running affected releases (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, or 11.0.0.0-11.0.0.2); restrict network access to trusted sources where feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Datapower Gateway 10 6Cd
View allUnauthenticated remote code execution in IBM DataPower Gateway affects the 10.5.0.0 through 10.5.0.22, 10.6.0.0 through
Empty-password LDAP authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers obtain adminis
A remotely reachable, unauthenticated out-of-bounds write (buffer overflow, CWE-787) in IBM DataPower Gateway can corrup
Arbitrary code execution in IBM DataPower Gateway is possible when a user with existing local access to the appliance su
Unauthenticated remote code execution affects IBM DataPower Gateway across multiple release streams - 10.5.0.0 through 1
An out-of-bounds write in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through
Unauthenticated remote attackers can trigger a memory-safety fault in IBM DataPower Gateway that crashes the affected se
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0
Heap-based buffer overflow (CWE-787) in IBM DataPower Gateway allows an unauthenticated remote attacker to crash the gat
Security-restriction bypass in IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 thro
Remote code execution in IBM DataPower Gateway (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0
Out-of-bounds write in IBM DataPower Gateway lets a remote, unauthenticated attacker corrupt memory and potentially exec
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today