IBM DataPower Gateway EUVD-2026-94988

Exploitation requires that the targeted DataPower Gateway service be configured to perform authentication/authorization using JSON Web Signature (JWS)/JWT verification - that signature-based trust mechanism is the exact feature whose improper verification is abused. Where that is in use, exploitation is remote and unauthenticated against the affected versions (10.5.0.0-10.5.0.22, 10.6.1-10.6.6, 10.6.0.0-10.6.0.10, 11.0.0.0-11.0.0.2) with no user interaction. The principal limiting factor is therefore deployment-specific: instances that do not rely on DataPower's JWS/JWT verification for access control are not exposed, and the integrity-only (C:N) base scoring suggests the primary payoff is trust/access forgery rather than direct data disclosure.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, unauthenticated, low-complexity authentication bypass, and the CWE-347 (improper cryptographic signature verification) root cause combined with SSVC Technical Impact 'total' means a successful forge grants full trust-boundary compromise of the gateway's authentication layer. These signals pull toward high priority. However, the mitigating signals are strong: EPSS is only 0.20% (9th percentile), SSVC Exploitation is 'none' and Automatable is 'no', the CVE is NOT in CISA KEV, and no public POC is referenced - so there is no public exploit identified at time of analysis. A notable tension exists between the base CVSS impact subscores and the vulnerability class: the vector reports C:N/I:H/A:N, meaning IBM scored this purely as an integrity impact, yet an authentication bypass on a security gateway would in practice often expose protected data (confidentiality) as well - this C:N is worth verifying against IBM advisory node 7289775, as it may understate real-world impact. Overall: a real vulnerability warranting prompt patching on affected DataPower deployments, but current intelligence indicates no active or automatable exploitation, so it is a 'patch in normal cycle / prioritize on internet-facing instances' issue rather than a drop-everything KEV-class threat.

A remote, unauthenticated attacker crafts a JSON Web Token whose JSON Web Signature is forged, exploiting DataPower Gateway's improper signature verification so the forged signature is accepted as valid. The attacker submits this token to an endpoint protected by DataPower's JWT/JWS-based authentication and is admitted as a trusted/authenticated principal without possessing any legitimate signing key. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS network vector and the CWE-347 description.