Datapower Gateway
Monthly
Remote, unauthenticated code execution is possible in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, because an out-of-bounds write in the RFC2047 encoded-word parser can corrupt memory and be leveraged to run arbitrary code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) indicates the flaw is network-reachable with low complexity, requires no credentials and no user interaction, and carries full confidentiality, integrity, and availability impact, though exploitation depends on a reachable service or flow that passes attacker-controlled data through MIME encoded-word decoding. According to available intelligence there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the primary source is IBM's advisory at https://www.ibm.com/support/pages/node/7289775.
Security restriction bypass in IBM DataPower Gateway leaves the appliance's authorization logic exploitable by unauthenticated remote attackers, allowing them to reach functionality or data that should have required elevated privileges. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; the CVSS 3.1 vector (7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms the attack is network-reachable with no credentials and no user interaction, but the high attack-complexity component means some condition outside the attacker's control - such as a particular request sequence, timing, or policy/configuration state - must be satisfied first, and the gateway service must be network-reachable at all. IBM's own PSIRT reported the issue and no public exploit code or confirmed active exploitation has been identified at time of analysis; impact is scored high for confidentiality and integrity with no availability impact, so the practical risk is unauthorized read/modification of gateway-mediated data or configuration rather than denial of service.
A heap buffer underwrite in IBM DataPower Gateway allows unauthenticated remote attackers to crash the gateway service, producing a denial-of-service condition on affected appliances. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), the flaw is reachable over the network with no privileges or user interaction required, and impact is confined to availability (C:N/I:N/A:H). Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or degrade an affected gateway by sending crafted input that the product fails to validate correctly, resulting in an out-of-bounds write in memory. All four supported release trains are affected: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms the attack is launched over the network with no authentication and no user interaction, and that the sole impact is availability - there is no confidentiality or integrity loss, so the risk is bounded to service outage on gateways whose vulnerable interface is reachable from untrusted networks. No public exploit code has been identified at time of analysis, no EPSS score was supplied, and CISA KEV does not list this CVE.
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or exhaust the message-processing service by sending crafted messages whose length field is mishandled during memory reallocation. All firmware levels in the ranges 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 are affected; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) indicates no authentication, user interaction, or non-default configuration is needed, and the only impact is loss of availability. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but because exploitation only requires network reachability to the gateway's message interface, internet- or partner-facing appliances should be treated as the highest-priority remediation targets.
A heap buffer overflow in IBM DataPower Gateway (affected firmware levels 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows remote attackers to crash the service and cause a denial of service; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, privileges, or user interaction are required, so any reachable affected gateway is a candidate target. Impact is confined to availability - the vendor reports no confidentiality or integrity loss and no code execution. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); this is a genuine availability risk but not a top-tier emergency, with practical exposure limited by how broadly the gateway's data-plane and management interfaces are reachable.
Unauthenticated remote attackers can exhaust system resources on IBM DataPower Gateway firmware releases 11.0.0.0 through 11.0.0.2, degrading or halting availability of the gateway's traffic and management services. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, user interaction, or special positioning are required once the affected interface is reachable, but impact is confined to availability - there is no data disclosure, tampering, or code execution component. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); the practical risk is therefore a bounded denial-of-service exposure that is highest where DataPower interfaces are internet-facing or unsegmented, and much lower where they sit behind network controls and rate limiting.
Denial of service affecting IBM DataPower Gateway builds 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, where a crafted GraphQL request containing a malformed variable causes a NULL pointer dereference that crashes or hangs the affected service. The flaw is network-reachable and requires no authentication (PR:N) and no user interaction (UI:N), but the HIGH attack complexity (AC:H) means the attacker must craft input that reliably reaches the dereference, so opportunistic mass exploitation is unlikely. Impact is availability-only with no data disclosure or modification, and no public exploit identified at time of analysis; this is a moderate, availability-only issue rather than a top-tier priority.
An out-of-bounds read in IBM DataPower Gateway (CWE-125) lets an attacker who already holds valid credentials on the gateway reach past intended buffer boundaries and have fragments of process memory returned to them, disclosing limited sensitive information. Affected release trains are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, as listed in ENISA EUVD-2026-94890 and IBM's advisory node/7289775. The base score is 5.3 with confidentiality-only, low-severity impact and no effect on integrity or availability; IBM's description requires a remote authenticated user, which the independent assessment reflects by treating the vector as PR:L instead of NVD's PR:N. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so realistic risk is confined to credentialed actors and compromised accounts rather than unauthenticated mass exploitation.
Server-side request forgery in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) lets an authenticated user who satisfies high-complexity preconditions make the appliance send requests to destinations of the attacker's choosing, enabling internal network enumeration and reconnaissance that can support follow-on attacks. Rated CVSS 4.9 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N), this is a moderate-severity, low-priority issue rather than an emergency: exploitation requires a valid authenticated session plus the ability to reach a request-handling function that accepts an attacker-influenced destination, and there is no public exploit identified at time of analysis, with real-world impact bounded by whatever sensitive internal hosts the gateway itself can reach. IBM has published an advisory covering these builds, and other versions are not in scope.
IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password change which. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request forgery (SSRF). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a local user, under special conditions, to obtain highly sensitive information from log files. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a chunked transfer-encoding HTTP/2 request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted a JSON request with invalid characters. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted HTTP/2 request with invalid characters. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, and continue to access the server even after authentication certificates have. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privileged user due to improper access controls. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of service, caused by the improper handling of full file system. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses weaker than expected cryptographic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5.1.9, 7.5.2.0 through 7.5.2.9, and 7.6.0.0 through 7.6.0.2 and IBM MQ Appliance. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM DataPower Gateway appliances with firmware 6.x before 6.0.0.17, 6.0.1.x before 6.0.1.17, 7.x before 7.0.0.10, 7.1.0.x before 7.1.0.7, and 7.2.x before 7.2.0.1 do not set the secure flag for. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. No vendor patch available.
Remote, unauthenticated code execution is possible in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, because an out-of-bounds write in the RFC2047 encoded-word parser can corrupt memory and be leveraged to run arbitrary code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) indicates the flaw is network-reachable with low complexity, requires no credentials and no user interaction, and carries full confidentiality, integrity, and availability impact, though exploitation depends on a reachable service or flow that passes attacker-controlled data through MIME encoded-word decoding. According to available intelligence there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the primary source is IBM's advisory at https://www.ibm.com/support/pages/node/7289775.
Security restriction bypass in IBM DataPower Gateway leaves the appliance's authorization logic exploitable by unauthenticated remote attackers, allowing them to reach functionality or data that should have required elevated privileges. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; the CVSS 3.1 vector (7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms the attack is network-reachable with no credentials and no user interaction, but the high attack-complexity component means some condition outside the attacker's control - such as a particular request sequence, timing, or policy/configuration state - must be satisfied first, and the gateway service must be network-reachable at all. IBM's own PSIRT reported the issue and no public exploit code or confirmed active exploitation has been identified at time of analysis; impact is scored high for confidentiality and integrity with no availability impact, so the practical risk is unauthorized read/modification of gateway-mediated data or configuration rather than denial of service.
A heap buffer underwrite in IBM DataPower Gateway allows unauthenticated remote attackers to crash the gateway service, producing a denial-of-service condition on affected appliances. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), the flaw is reachable over the network with no privileges or user interaction required, and impact is confined to availability (C:N/I:N/A:H). Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or degrade an affected gateway by sending crafted input that the product fails to validate correctly, resulting in an out-of-bounds write in memory. All four supported release trains are affected: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms the attack is launched over the network with no authentication and no user interaction, and that the sole impact is availability - there is no confidentiality or integrity loss, so the risk is bounded to service outage on gateways whose vulnerable interface is reachable from untrusted networks. No public exploit code has been identified at time of analysis, no EPSS score was supplied, and CISA KEV does not list this CVE.
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or exhaust the message-processing service by sending crafted messages whose length field is mishandled during memory reallocation. All firmware levels in the ranges 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 are affected; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) indicates no authentication, user interaction, or non-default configuration is needed, and the only impact is loss of availability. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but because exploitation only requires network reachability to the gateway's message interface, internet- or partner-facing appliances should be treated as the highest-priority remediation targets.
A heap buffer overflow in IBM DataPower Gateway (affected firmware levels 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows remote attackers to crash the service and cause a denial of service; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, privileges, or user interaction are required, so any reachable affected gateway is a candidate target. Impact is confined to availability - the vendor reports no confidentiality or integrity loss and no code execution. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); this is a genuine availability risk but not a top-tier emergency, with practical exposure limited by how broadly the gateway's data-plane and management interfaces are reachable.
Unauthenticated remote attackers can exhaust system resources on IBM DataPower Gateway firmware releases 11.0.0.0 through 11.0.0.2, degrading or halting availability of the gateway's traffic and management services. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, user interaction, or special positioning are required once the affected interface is reachable, but impact is confined to availability - there is no data disclosure, tampering, or code execution component. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); the practical risk is therefore a bounded denial-of-service exposure that is highest where DataPower interfaces are internet-facing or unsegmented, and much lower where they sit behind network controls and rate limiting.
Denial of service affecting IBM DataPower Gateway builds 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, where a crafted GraphQL request containing a malformed variable causes a NULL pointer dereference that crashes or hangs the affected service. The flaw is network-reachable and requires no authentication (PR:N) and no user interaction (UI:N), but the HIGH attack complexity (AC:H) means the attacker must craft input that reliably reaches the dereference, so opportunistic mass exploitation is unlikely. Impact is availability-only with no data disclosure or modification, and no public exploit identified at time of analysis; this is a moderate, availability-only issue rather than a top-tier priority.
An out-of-bounds read in IBM DataPower Gateway (CWE-125) lets an attacker who already holds valid credentials on the gateway reach past intended buffer boundaries and have fragments of process memory returned to them, disclosing limited sensitive information. Affected release trains are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, as listed in ENISA EUVD-2026-94890 and IBM's advisory node/7289775. The base score is 5.3 with confidentiality-only, low-severity impact and no effect on integrity or availability; IBM's description requires a remote authenticated user, which the independent assessment reflects by treating the vector as PR:L instead of NVD's PR:N. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so realistic risk is confined to credentialed actors and compromised accounts rather than unauthenticated mass exploitation.
Server-side request forgery in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) lets an authenticated user who satisfies high-complexity preconditions make the appliance send requests to destinations of the attacker's choosing, enabling internal network enumeration and reconnaissance that can support follow-on attacks. Rated CVSS 4.9 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N), this is a moderate-severity, low-priority issue rather than an emergency: exploitation requires a valid authenticated session plus the ability to reach a request-handling function that accepts an attacker-influenced destination, and there is no public exploit identified at time of analysis, with real-world impact bounded by whatever sensitive internal hosts the gateway itself can reach. IBM has published an advisory covering these builds, and other versions are not in scope.
IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password change which. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request forgery (SSRF). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a local user, under special conditions, to obtain highly sensitive information from log files. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a chunked transfer-encoding HTTP/2 request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted a JSON request with invalid characters. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted HTTP/2 request with invalid characters. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, and continue to access the server even after authentication certificates have. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privileged user due to improper access controls. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of service, caused by the improper handling of full file system. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses weaker than expected cryptographic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5.1.9, 7.5.2.0 through 7.5.2.9, and 7.6.0.0 through 7.6.0.2 and IBM MQ Appliance. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM DataPower Gateway appliances with firmware 6.x before 6.0.0.17, 6.0.1.x before 6.0.1.17, 7.x before 7.0.0.10, 7.1.0.x before 7.1.0.7, and 7.2.x before 7.2.0.1 do not set the secure flag for. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. No vendor patch available.