IBM DataPower Gateway EUVD-2026-94999

Exploitation requires local access to the DataPower Gateway appliance (CVSS AV:L) plus a valid low-privileged account (PR:L) - it is not remotely or anonymously exploitable. No user interaction is needed (UI:N) and complexity is low (AC:L), so any authenticated low-privilege user on an affected build can trigger it. Affected builds: 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6 (10.6CD), and 11.0.0.0-11.0.0.2; systems on fixed versions per IBM node 7289775 are not exposed. The primary limiting factors are the mandatory local foothold and existing authenticated access, which confine realistic risk to insiders or post-compromise scenarios rather than external unauthenticated attackers.

This is a genuine but comparatively lower-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N = 6.5 Medium) describes a locally-accessible, low-complexity flaw that requires existing low-level privileges and yields only confidentiality impact (improper authorization, CWE-863), with no integrity or availability effect. All exploitation signals converge on low real-world urgency: there is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' CISA's SSVC framework independently corroborates this, rating Exploitation: none, Automatable: no, and Technical Impact: partial - meaning no mass-scanning/wormable path and only partial impact. The one point of mild tension is the Scope:Changed metric (S:C) combined with C:H, which elevates the score and implies the disclosed data crosses a trust/authorization boundary (plausible for a multi-domain gateway appliance); the IBM advisory text does not detail exactly what sensitive information is exposed, so the precise blast radius should be verified against node 7289775. Overall: a real, vendor-confirmed and patched authorization defect that warrants routine patching, not emergency response, because it needs local access plus valid low-privilege credentials and carries no automatable or widespread-exploitation indicators.

A low-privileged user who already has local/management-plane access to a DataPower Gateway appliance (e.g., an operator with a restricted account) leverages the improper authorization check to read sensitive information they should not be authorized to view, such as data belonging to another administrative domain or security context. No public exploit code or active exploitation has been identified, and because the attack vector is local and authenticated, exploitation is limited to insiders or an attacker who has already gained a foothold on the device.