IBM DataPower Gateway EUVD-2026-95001

Exploitation requires an authenticated session on the IBM DataPower Gateway (CVSS PR:L), so the attacker must hold valid low-privilege credentials or an existing foothold on the appliance; it cannot be performed by an unauthenticated remote attacker. The specific trigger is submitting signature requests that the gateway processes with improper verification of data authenticity (CWE-345), enabling forgery. Affected deployments are limited to DataPower Gateway firmware 10.5.0.0-10.5.0.22, 10.6.1-10.6.6, 10.6.0.0-10.6.0.10, and 11.0.0.0-11.0.0.2; the authentication requirement and integrity-only impact (no data exposure or service disruption) are the key limiting factors for defenders.

This is a moderate-risk, authenticated integrity vulnerability rather than a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) confirms a network-reachable, low-complexity attack that requires low-privilege authentication (PR:L), with impact limited entirely to integrity (I:H) - no confidentiality (C:N) or availability (C:N/A:N) loss. No EPSS score, KEV listing, or POC was provided, and there is no public exploit identified at time of analysis, which argues against widespread opportunistic exploitation. The requirement for valid authentication (PR:L) meaningfully limits the attacker population to users who already have some access to the gateway, making this more relevant to insider-threat and post-compromise scenarios than to mass exploitation. A notable data conflict: the input Tags label this 'Information Disclosure,' but the CVSS vector sets C:N and the CWE is CWE-345 (improper verification of data authenticity), so the real impact is signature forgery / integrity, not disclosure - the tag appears mislabeled and should not drive triage.

An authenticated low-privilege user of the DataPower Gateway submits a crafted signature request that the gateway fails to properly verify for data authenticity, allowing the user to forge signatures on data the gateway processes or signs. No public exploit code is known, and because valid authentication is required (PR:L), the attacker must already possess gateway credentials or a foothold.