IBM DataPower Gateway EUVD-2026-94995

Exploitation requires an authenticated session with at least low privileges (CVSS PR:L) and network reachability to the DataPower Gateway management or processing interface, plus the ability to invoke an operation that exercises the vulnerable key-derivation routine (e.g., a cryptographic/TLS key-derivation operation). Limiting factors: valid credentials are mandatory (not exploitable pre-auth), the affected build range is narrow (11.0.0.0-11.0.0.2 only), and a vendor patch exists, so exposure is confined to unpatched appliances where attackers can obtain even limited authenticated access. Impact is denial of service only - no data disclosure or modification.

This is a medium-to-high priority availability flaw whose real-world risk is moderated by its authentication requirement. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, base 7.7) indicates a network-reachable, low-complexity attack but one that requires at least low-level authenticated privileges (PR:L) - it is not an unauthenticated internet-facing bug. The scope change (S:C) elevates the score because a crash of the DataPower Gateway degrades availability for the downstream services and traffic it fronts, not just the component itself. Impact is confined to availability (C:N/I:N) - there is no confidentiality or integrity exposure despite the 'Memory Corruption'/'Buffer Overflow' tags, consistent with CWE-787 (out-of-bounds write) being exploited only for denial of service. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable exploitation; the signals do not conflict, they are simply absent. Net: a genuine availability concern for exposed DataPower appliances where attackers can obtain even limited credentials, but not a drop-everything internet-wormable issue. Missing data to note explicitly: no EPSS and no exploitation evidence were supplied, so likelihood of exploitation cannot be quantified from this input.

An attacker holding low-privilege authenticated access to an IBM DataPower Gateway (11.0.0.0-11.0.0.2) sends requests that trigger the key-derivation code path, causing improper memory allocation and an out-of-bounds write that crashes or destabilizes the gateway. Because the gateway brokers traffic for downstream applications, the resulting denial of service extends beyond the appliance itself. No public exploit code is identified at time of analysis.