IBM DataPower Gateway EUVD-2026-94990

The gateway must be running an affected build - DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.1-10.6.6 (10.6CD), 10.6.0.0-10.6.0.10, or 11.0.0.0-11.0.0.2 - and have a network-reachable listener accepting the request type that reaches the vulnerable parser. Per CVSS PR:N/UI:N, exploitation is unauthenticated and requires no user interaction, so no special configuration is named in the description as a precondition. Limiting factors: the appliance must be reachable from the attacker's network position (DataPower is typically a gateway so exposure depends on whether the affected listener faces untrusted networks), and the realistic outcome may be memory disclosure or DoS rather than full compromise given the CWE-125 read classification and SSVC 'partial' technical impact. The IBM fix should be applied to move to a non-affected build.

Signals conflict, and that conflict is the headline. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) describes a remote, unauthenticated, low-complexity attack with total impact on confidentiality, integrity and availability. However, three independent signals pull strongly against treating this as an active priority: (1) EPSS is only 0.22% (12th percentile), indicating very low modeled exploitation probability; (2) CISA SSVC scores Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial' - the 'partial' rating directly contradicts the CVSS claim of total (C:H/I:H/A:H) impact; and (3) the CWE is CWE-125 (out-of-bounds READ), and the tag set includes 'Information Disclosure', both of which point to a memory-disclosure/crash primitive rather than the arbitrary code execution that a full 9.8 'I:H' normally implies. There is no CISA KEV listing and no public POC. Net assessment: this is a classic high-CVSS / low-real-world-risk case right now - patch it in normal cycles, but it does not warrant emergency out-of-band response. The CWE-125 vs C:H/I:H/A:H discrepancy should be verified against IBM advisory node/7289775, as the true integrity impact may be lower than the headline score suggests.

A remote, unauthenticated attacker sends a crafted request or malformed protocol message to an internet- or network-reachable IBM DataPower Gateway listener, triggering an out-of-bounds read in the parsing path. Depending on the actual primitive, this leaks adjacent process memory (consistent with the CWE-125 / Information Disclosure classification) or crashes the gateway, causing denial of service. No public exploit code has been identified at time of analysis, and realistic weaponization is unproven given the low EPSS and SSVC 'Exploitation: none' rating.