IBM DataPower Gateway EUVD-2026-94972

No special configuration conditions are stated: the flaw is a remote, unauthenticated availability issue (AV:N/AC:L/PR:N/UI:N) reachable against affected DataPower Gateway builds in default operation, triggered when attacker-influenced input reaches the vulnerable sorting comparator that violates strict-weak-ordering and causes an out-of-bounds access. Exploitation is limited to running an affected version - DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, or 11.0.0.0 through 11.0.0.2 - and the impact is confined to denial of service; there is no confidentiality or integrity effect and no privilege gain, so defenders should weigh this primarily as an uptime/availability risk for exposed gateways.

This is a genuine but bounded operational risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated flaw, and the A:H / C:N / I:N profile makes it a pure availability (denial-of-service) issue - there is no data disclosure or code-execution impact claimed, so the base score of 7.5 is driven entirely by uptime risk. Although CWE-787 (out-of-bounds write) and the 'Buffer Overflow'/'Memory Corruption' tags might suggest memory-corruption-to-RCE potential, both the description and the CVSS impact metrics scope this strictly to a crash/DoS from an out-of-bounds memory access triggered by a strict-weak-ordering violation in a sorting comparator; do not treat it as RCE without further vendor confirmation. No EPSS score, SSVC decision data, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified - the absence of these signals is not evidence of safety but does mean there is no current indication of active or automatable exploitation. Net: prioritize patching for internet-facing or high-availability DataPower deployments because of the unauthenticated network DoS, but this is not a confidentiality/integrity breach and shows no confirmed exploitation to date.

A remote, unauthenticated attacker sends specially crafted input that drives the vulnerable sorting routine, whose comparator violates strict-weak-ordering and causes an out-of-bounds memory access. The resulting crash of the DataPower Gateway process interrupts API, message-routing, and security-gateway services for all downstream consumers. No public exploit code was identified in the provided data, but the low attack complexity (AC:L) means a reliable trigger would be straightforward once the input path is understood.