IBM DataPower Gateway EUVD-2026-94994

The description states no configuration prerequisite, feature flag, or deployment mode - it indicates a remotely reachable, unauthenticated flaw affecting IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.1-10.6.6, 10.6.0.0-10.6.0.10, and 11.0.0.0-11.0.0.2. The primary limiting factors are: (1) the target must run one of these specific affected version ranges; (2) the gateway endpoint must be network-reachable by the attacker; and (3) as a use-after-free (CWE-416), reliable triggering typically depends on specific request sequencing and memory/timing state, which can make consistent exploitation - especially controlled information disclosure versus a simple crash - less reliable than the AC:L rating implies. No user interaction or authentication is required per the CVSS vector (PR:N/UI:N).

Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated flaw scoring 9.1 Critical, with high confidentiality and availability impact - which on paper looks urgent. However, the real-world exploitation signals are notably softer: EPSS is only 0.24% (14th percentile), the CVE is NOT in CISA KEV, no public POC is referenced, and CISA SSVC explicitly rates Exploitation=none, Automatable=no, and Technical Impact=partial. This convergence of low-exploitation signals suggests the Critical CVSS is driven largely by the theoretical impact (memory disclosure + crash) and the unauthenticated network vector rather than by demonstrated or likely mass exploitation. The SSVC 'Automatable: no' is consistent with CWE-416 use-after-free bugs, which frequently require specific timing or memory-state conditions to trigger reliably despite a nominal AC:L rating - this is a tension worth noting: the formal vector says low complexity, but UAF exploitation for reliable info-leak or controlled DoS is typically non-trivial. Net: this is a patch-promptly item for organizations running affected IBM DataPower Gateway versions, but current evidence points to a theoretical/high-severity-but-low-active-risk posture rather than an emergency, widely-exploited threat.

A remote, unauthenticated attacker sends specially crafted requests to an internet- or network-reachable IBM DataPower Gateway to trigger a use-after-free in request processing, causing the gateway to disclose fragments of sensitive process memory and/or crash the service. No public exploit code is identified at time of analysis, and reliable triggering of the use-after-free likely depends on memory state and timing. Because DataPower commonly front-ends APIs and integration traffic, a successful crash degrades availability for all services behind the gateway.