Datapower Gateway 10 6 0
Monthly
Unauthenticated remote code execution in IBM DataPower Gateway affects the 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 release trains, where a heap-based buffer overflow caused by improper bounds checking lets an attacker who can reach the appliance's request-processing path corrupt heap memory and run arbitrary code with full confidentiality, integrity and availability impact. The flaw is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required, and it is exploitable over the network. There is no public exploit identified at time of analysis and it is not confirmed actively exploited (no CISA KEV listing); IBM has published a vendor fix, and this is a genuine high-priority issue rather than an inflated high-CVSS score.
Unauthenticated remote attackers can trigger a memory-safety fault in IBM DataPower Gateway that crashes the affected service, producing a denial-of-service condition; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, score 8.2) confirms network reachability with no authentication, no user interaction, and no unusual configuration required, while availability impact is High and there is a limited Confidentiality impact from potential leakage of adjacent memory. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. This issue is not confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis, but a vendor patch is available and the affected versions are frequently internet-facing, so prioritization should follow normal critical-exposure timelines rather than emergency response.
Security-restriction bypass in IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 allows a remote authenticated attacker to have forged or tampered cryptographic signatures accepted by the gateway, defeating the trust checks those signatures are meant to enforce. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1), the attacker must already hold valid low-privilege credentials and have network reachability to the gateway, but no user interaction is required, and successful exploitation yields high confidentiality and integrity impact with no availability effect. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the primary limiting factor is the authentication prerequisite, which excludes fully unauthenticated external attackers.
Empty-password LDAP authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers obtain administrative access to affected appliances by submitting a blank password that the LDAP authentication logic fails to reject. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; exploitation requires only that LDAP be configured for administrative/management authentication and that the authentication interface be network-reachable. At time of analysis there is no public exploit identified, but IBM has published a vendor fix, and the combination of network-only attack surface, no authentication prerequisite, and full confidentiality/integrity/availability impact warrants emergency-level prioritization in any environment using LDAP-backed management logins.
Unauthenticated remote attackers can trigger a use-after-free in IBM DataPower Gateway, resulting in a denial of service and potential disclosure of sensitive information held in freed memory. The flaw affects the 10.5.0 branch (10.5.0.0 through 10.5.0.22), the 10.6.0 branch (10.6.0.0 through 10.6.0.10), the 10.6CD/10.6.1 branch (10.6.1 through 10.6.6), and the 11.0.0 branch (11.0.0.0 through 11.0.0.2); the CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:H) rates it 9.1, but exploitation requires the gateway endpoint to be network-reachable and, as a memory-safety bug, reliable triggering typically depends on request sequencing and allocator/timing state. There is no public exploit identified at time of analysis, EPSS is low at 0.24% (14th percentile), and CISA's SSVC framework records exploitation as none and automatable as no - signals are therefore mixed between a high headline severity score and a low observed exploitation likelihood. A vendor patch is available per IBM's advisory.
Remote code execution in IBM DataPower Gateway (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2) is caused by a heap-based buffer overflow that a remote attacker can trigger without authentication or user interaction, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) with total impact to confidentiality, integrity, and availability. Exploitation is not confirmed by any signal: no public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, SSVC reports Exploitation=none with Automatable=no, and EPSS is only 0.37% (29th percentile). The practical risk therefore hinges on whether affected DataPower builds are reachable from untrusted networks, since IBM has published a fix and the high base score reflects worst-case impact rather than observed attack activity.
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 lets remote, unauthenticated attackers who can reach an XML-accepting endpoint read files or internal resources from the gateway host and, via entity expansion, exhaust memory. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) confirms no credentials or user interaction are required, with high confidentiality impact and low availability impact. There is no public exploit code and no indication of active exploitation, and IBM has published a patch through its support portal.
Out-of-bounds memory handling in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2) allows network attackers to trigger a buffer overflow that can disclose sensitive process memory or crash the appliance. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), exploitation is unauthenticated and requires no user interaction, with high confidentiality and availability impact but no integrity impact - consistent with the CWE-125 out-of-bounds read classification rather than a write-based code-execution primitive. No public exploit code was identified at time of analysis, CISA SSVC records exploitation as 'none' and automation as 'no', and EPSS is low at 0.22% (12th percentile); note that the vendor's own 9.8 rating assumes full C/I/A impact, which this assessment does not corroborate. Patch available per vendor advisory (IBM support page node/7289775).
Authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers forge JSON Web Signatures and present themselves as a trusted, already-verified identity on gateways that use JWS/JWT signature verification for access control. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) exploitation requires no credentials or user interaction and the impact is integrity-only, meaning the payoff is forged trust and unauthorized access rather than direct data disclosure. No public exploit identified at time of analysis, EPSS is low at 0.20% (9th percentile), and the CISA SSVC assessment records exploitation as none with automation not feasible, so this is a genuine but moderate-priority issue rather than a top-tier emergency; vendor patches are nonetheless available.
A remotely reachable, unauthenticated out-of-bounds write (buffer overflow, CWE-787) in IBM DataPower Gateway can corrupt memory and potentially allow an attacker to fully compromise the affected appliance, as reflected in the assessed CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with the flaw reachable in the normal network-processing path since no authentication, user interaction, or special configuration is required. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, though the unauthenticated network attack surface and memory-corruption impact make this a genuine high-priority issue for exposed deployments; IBM has published a vendor fix via its support advisory.
Cross-site scripting in the IBM DataPower Gateway 10.6.0 Web UI (builds 10.6.0.0 through 10.6.0.10) lets an unauthenticated attacker inject arbitrary JavaScript that executes in the browser of an operator who is already logged into the appliance management console, potentially leading to credential or session disclosure within that trusted session. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3) confirms the attacker needs no credentials but the victim must interact with attacker-supplied content, so this is a lure-driven, high-impact issue rather than silent mass exploitation; no public exploit has been identified at time of analysis. A vendor patch is available, and only the 10.6.0.x range up to 10.6.0.10 is affected, so upgrading the fixed build removes exposure.
Arbitrary code execution in IBM DataPower Gateway is possible when a user with existing local access to the appliance supplies crafted oversized input to a component that performs improper bounds checking, allowing an out-of-bounds write and, potentially, execution of arbitrary code in the appliance's process context. Affected release trains are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; IBM has published a vendor fix, and no public exploit code was identified at time of analysis. Note that the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8) characterizes this as remotely exploitable without privileges, which is inconsistent with the description's requirement for a local user and with the independent assessment of AV:L/AC:L/PR:L/UI:N - the local-access prerequisite is the practical limiter on real-world risk, while the impact if triggered remains full confidentiality, integrity, and availability loss.
Stack-based buffer overflow in IBM DataPower Gateway firmware tracks 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 allows an authenticated attacker holding administrative-level privileges to execute arbitrary code on the gateway. Exploitation is network reachable but gated by high attack complexity (AC:H), meaning the attacker depends on conditions they cannot fully control, such as a specific memory layout or parsing state, so a single deterministic trigger is not guaranteed; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); IBM has released patched builds via its support advisory.
Out-of-bounds write in IBM DataPower Gateway lets a remote, unauthenticated attacker corrupt memory and potentially execute arbitrary code on affected gateway builds (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2), as reflected in the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 8.1. The PR:N/UI:N components mean no credentials or user interaction are required, so any network-reachable instance on an affected build is exposed, though the AC:H rating indicates exploitation depends on satisfying a non-trivial condition - most likely a specific input state, parsing path, or memory layout - to escalate the write beyond a crash into reliable code execution. Vendor patch data indicates a fix is available from IBM, and no public exploit code or confirmed active exploitation was identified at time of analysis; the EPSS score was not provided in the underlying intelligence, so no probabilistic exploitation estimate can be quoted.
Unauthenticated remote code execution affects IBM DataPower Gateway across multiple release streams - 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 - stemming from an out-of-bounds write (CWE-787) that corrupts memory and can be leveraged to run attacker-controlled code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the flaw is reachable over the network with no authentication and no user interaction, making any internet- or partner-facing DataPower instance running an unpatched build a high-priority target. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; patch available per vendor advisory (IBM support page node/7289775), with the specific fixed firmware builds published there.
IBM DataPower Gateway can be driven into a denial-of-service condition by a remote, unauthenticated attacker who supplies input that reaches a flawed sorting comparator, causing the comparator to violate strict-weak-ordering and triggering an out-of-bounds memory access (CWE-787) that can crash or destabilize the affected service. All builds in the 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 ranges are affected; the impact is confined to availability (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity effect and no privilege gain. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and IBM has published a fix via its support advisory, so this should be treated as a patching-priority availability risk rather than an emergency.
Unauthenticated remote attackers can drive IBM DataPower Gateway into resource exhaustion and denial of service by sending crafted GraphQL queries that abuse improper memoization of fragment spreads. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, and per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector no authentication or user interaction is required once a reachable GraphQL-processing endpoint exists. Impact is confined to availability (no confidentiality or integrity loss), and there is no public exploit identified at time of analysis; exposure depends entirely on whether the gateway has been configured to accept and process GraphQL requests.
Heap-based buffer overflow (CWE-787) in IBM DataPower Gateway allows an unauthenticated remote attacker to crash the gateway and cause a denial of service. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required, so any attacker who can reach a listening interface and deliver a crafted request to the vulnerable parsing path can trigger the fault. The assessed impact is availability-only (A:H, C:N/I:N) rated 8.2 High; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is governed mainly by network exposure of the gateway's listening interfaces. This is a genuine but tier-two priority issue rather than an emergency, with patches available from IBM.
A type confusion flaw (CWE-843) in IBM DataPower Gateway lets a remote, unauthenticated attacker crash a reachable gateway service, producing a denial-of-service condition. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a network-reachable, low-complexity, unauthenticated trigger with availability-only impact. IBM has published a vendor fix via its support advisory, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
Out-of-bounds write in IBM DataPower Gateway lets unauthenticated remote attackers corrupt process memory, resulting in disclosure of sensitive information and denial of service. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with a CVSS 3.1 base score of 8.6 driven by high availability impact alongside limited confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and IBM has made a fix available through its support advisory, so this is a credible operational priority rather than a confirmed emergency - exposure depends on whether the gateway's network listeners are reachable by the attacker.
IBM DataPower Gateway is vulnerable to a remote, unauthenticated denial of service (CVSS 3.1 base 7.5) in which a crafted request triggers an out-of-bounds read, degrading or crashing the affected gateway service. All supported firmware streams in the affected ranges are exposed: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6 (the 10.6 CD stream), and 11.0.0.0 through 11.0.0.2. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms exploitable over the network with no authentication, privileges, or user interaction, but restricts impact to availability - no confidentiality or integrity loss is assessed - so exploitation results in service disruption rather than compromise; there is no public exploit identified at time of analysis, and a vendor patch is available.
Denial of service in IBM DataPower Gateway affects releases 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, where crafted network input reaching the vulnerable parsing path overflows a buffer and can crash the affected service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), exploitation requires no authentication and no user interaction, so any internet- or partner-facing listener that processes malformed input is exposed; impact is availability-only - a crash/restart condition rather than data exposure or code execution. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV), so this is a genuine but bounded operational risk that depends primarily on whether affected listeners are reachable from untrusted networks.
Unauthenticated remote attackers can crash IBM DataPower Gateway by sending a crafted request that triggers a null pointer dereference, resulting in a denial of service that takes the affected service interface offline. All four maintained release trains are affected: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or privileged position is needed - only network reachability to a vulnerable, unpatched gateway - and the sole impact is availability (C:N/I:N/A:H), with no data exposure or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible but bounded availability risk that is governed primarily by how exposed the gateway's service interfaces are to untrusted networks.
An out-of-bounds write in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows an unauthenticated remote attacker to corrupt gateway memory, most reliably causing a denial of service and potentially enabling partial confidentiality or integrity compromise. The flaw carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), and the vector's PR:N/UI:N components confirm no credentials or user interaction are required to reach the vulnerable code - the practical limiting factor is whether the attacker's network can reach a DataPower service listener. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix via IBM Support (node/7289775).
Denial of service in IBM DataPower Gateway lets unauthenticated remote attackers send crafted network traffic that triggers an out-of-bounds write (CWE-787), degrading or halting the gateway's availability. The flaw affects version lines 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, scoring CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with availability-only impact. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but IBM has published a vendor fix, so internet-facing gateways should be treated as the highest-priority upgrade target.
Denial of service in IBM DataPower Gateway (versions 10.5.0, 10.6.0, 10.6cd, and 11.0.0) allows a remote unauthenticated attacker to exhaust system resources due to improper resource limitations (CWE-770), rendering the gateway unavailable. The CVSS 3.1 base score is 7.5 with an availability-only impact (A:H) and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch is available.
Signature forgery in IBM DataPower Gateway lets an authenticated user with valid low-privilege credentials submit signature requests that the appliance processes without properly verifying data authenticity, producing forged signatures that relying parties may accept as genuine. Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; the impact is integrity-only (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with no confidentiality or availability loss. There is no public exploit identified at time of analysis, and IBM has published a vendor fix via its support portal, so this is a moderate-risk authenticated integrity issue rather than a remotely exploitable, unauthenticated critical defect.
Stored/reflected cross-site scripting in the administrative Web UI of IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) lets an authenticated user whose input is rendered back into UI pages embed arbitrary JavaScript that executes in the browser of another, potentially more-privileged user, enabling credential or session disclosure inside the trusted management session. The flaw is not self-executing: it requires a low-privileged authenticated position (PR:L) plus a second victim who views the injected content (UI:R), and there is no public exploit identified at time of analysis, nor is it listed in CISA KEV. At CVSS 5.4 (CWE-79) this is a genuine but non-urgent issue, with realistic risk confined to deployments whose management Web UI is reachable by multiple users of differing privilege levels.
Improper authorization in IBM DataPower Gateway lets a local attacker who already holds a valid low-privileged account read sensitive information that should be restricted from that privilege level. Exposure is limited to specific builds: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6 (10.6CD), and 11.0.0.0 through 11.0.0.2. Exploitation requires local access to the appliance plus authenticated credentials (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so realistic risk is confined to insiders or post-compromise scenarios; CISA SSVC records no known exploitation, no public exploit code is identified at time of analysis, and IBM has published a vendor patch (support node 7289775).
Denial of service in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows a remote unauthenticated attacker to degrade or stall request processing by submitting input that forces worst-case algorithmic complexity during linked-list traversal. Rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), the flaw is an availability-only issue: the CVSS AC:H rating reflects that the attacker must craft input to hit the pathological code path rather than simply flooding the gateway with arbitrary traffic, and impact is confined to service degradation or denial with no confidentiality or integrity effect. No public exploit identified at time of analysis, and a vendor patch is available.
Race condition in IBM DataPower Gateway across three concurrent version lines (10.5.0.x, 10.6.0.x, and 11.0.0.x) permits state contamination of the built-in X-Client-IP header under concurrent request load, enabling IP spoofing and cross-client IP address disclosure. The flaw resides in IBM's enterprise API gateway and integration middleware, commonly deployed in high-throughput service meshes where simultaneous request processing is routine. IBM has released a patch via advisory 7282770, and no public exploit has been identified at time of analysis.
XML External Entity injection in IBM DataPower Gateway 10.5.0, 10.6.0, and 10.6CD allows a privileged authenticated user who can submit XML data to the gateway to either exfiltrate sensitive information from the underlying system or trigger memory exhaustion through recursive or large entity expansion. The vulnerability exists in the gateway's XML processing pipeline, a core function of this API/ESB platform. No public exploit code has been identified at time of analysis, and the vendor has released a patch documented in IBM Security Advisory 7278748.
IBM DataPower Gateway versions 10.5.0.0-10.5.0.20, 10.6.0.0-10.6.0.8, and 10.6.1.0-10.6.5.0 are vulnerable to cross-site request forgery (CSRF) that allows unauthenticated remote attackers to execute unauthorized actions on behalf of trusted users with user interaction. The vulnerability carries a CVSS score of 6.5 with medium real-world risk due to the requirement for user interaction and the integrity-only impact.
IBM DataPower Gateway versions 10.6CD (10.6.1.0-10.6.5.0), 10.5.0 (10.5.0.0-10.5.0.20), and 10.6.0 (10.6.0.0-10.6.0.8) disclose sensitive system information from other domains to authenticated administrative users due to improper access control. The vulnerability requires high-privilege administrative access over the network and results in confidentiality impact only; no public exploit code or active exploitation has been confirmed. CVSS 4.1 reflects low real-world risk due to authentication requirement, though patch availability limits exposure window.
Unauthenticated remote code execution in IBM DataPower Gateway affects the 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 release trains, where a heap-based buffer overflow caused by improper bounds checking lets an attacker who can reach the appliance's request-processing path corrupt heap memory and run arbitrary code with full confidentiality, integrity and availability impact. The flaw is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required, and it is exploitable over the network. There is no public exploit identified at time of analysis and it is not confirmed actively exploited (no CISA KEV listing); IBM has published a vendor fix, and this is a genuine high-priority issue rather than an inflated high-CVSS score.
Unauthenticated remote attackers can trigger a memory-safety fault in IBM DataPower Gateway that crashes the affected service, producing a denial-of-service condition; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, score 8.2) confirms network reachability with no authentication, no user interaction, and no unusual configuration required, while availability impact is High and there is a limited Confidentiality impact from potential leakage of adjacent memory. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. This issue is not confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis, but a vendor patch is available and the affected versions are frequently internet-facing, so prioritization should follow normal critical-exposure timelines rather than emergency response.
Security-restriction bypass in IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 allows a remote authenticated attacker to have forged or tampered cryptographic signatures accepted by the gateway, defeating the trust checks those signatures are meant to enforce. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1), the attacker must already hold valid low-privilege credentials and have network reachability to the gateway, but no user interaction is required, and successful exploitation yields high confidentiality and integrity impact with no availability effect. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the primary limiting factor is the authentication prerequisite, which excludes fully unauthenticated external attackers.
Empty-password LDAP authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers obtain administrative access to affected appliances by submitting a blank password that the LDAP authentication logic fails to reject. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; exploitation requires only that LDAP be configured for administrative/management authentication and that the authentication interface be network-reachable. At time of analysis there is no public exploit identified, but IBM has published a vendor fix, and the combination of network-only attack surface, no authentication prerequisite, and full confidentiality/integrity/availability impact warrants emergency-level prioritization in any environment using LDAP-backed management logins.
Unauthenticated remote attackers can trigger a use-after-free in IBM DataPower Gateway, resulting in a denial of service and potential disclosure of sensitive information held in freed memory. The flaw affects the 10.5.0 branch (10.5.0.0 through 10.5.0.22), the 10.6.0 branch (10.6.0.0 through 10.6.0.10), the 10.6CD/10.6.1 branch (10.6.1 through 10.6.6), and the 11.0.0 branch (11.0.0.0 through 11.0.0.2); the CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:H) rates it 9.1, but exploitation requires the gateway endpoint to be network-reachable and, as a memory-safety bug, reliable triggering typically depends on request sequencing and allocator/timing state. There is no public exploit identified at time of analysis, EPSS is low at 0.24% (14th percentile), and CISA's SSVC framework records exploitation as none and automatable as no - signals are therefore mixed between a high headline severity score and a low observed exploitation likelihood. A vendor patch is available per IBM's advisory.
Remote code execution in IBM DataPower Gateway (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2) is caused by a heap-based buffer overflow that a remote attacker can trigger without authentication or user interaction, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) with total impact to confidentiality, integrity, and availability. Exploitation is not confirmed by any signal: no public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, SSVC reports Exploitation=none with Automatable=no, and EPSS is only 0.37% (29th percentile). The practical risk therefore hinges on whether affected DataPower builds are reachable from untrusted networks, since IBM has published a fix and the high base score reflects worst-case impact rather than observed attack activity.
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 lets remote, unauthenticated attackers who can reach an XML-accepting endpoint read files or internal resources from the gateway host and, via entity expansion, exhaust memory. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) confirms no credentials or user interaction are required, with high confidentiality impact and low availability impact. There is no public exploit code and no indication of active exploitation, and IBM has published a patch through its support portal.
Out-of-bounds memory handling in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2) allows network attackers to trigger a buffer overflow that can disclose sensitive process memory or crash the appliance. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), exploitation is unauthenticated and requires no user interaction, with high confidentiality and availability impact but no integrity impact - consistent with the CWE-125 out-of-bounds read classification rather than a write-based code-execution primitive. No public exploit code was identified at time of analysis, CISA SSVC records exploitation as 'none' and automation as 'no', and EPSS is low at 0.22% (12th percentile); note that the vendor's own 9.8 rating assumes full C/I/A impact, which this assessment does not corroborate. Patch available per vendor advisory (IBM support page node/7289775).
Authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers forge JSON Web Signatures and present themselves as a trusted, already-verified identity on gateways that use JWS/JWT signature verification for access control. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) exploitation requires no credentials or user interaction and the impact is integrity-only, meaning the payoff is forged trust and unauthorized access rather than direct data disclosure. No public exploit identified at time of analysis, EPSS is low at 0.20% (9th percentile), and the CISA SSVC assessment records exploitation as none with automation not feasible, so this is a genuine but moderate-priority issue rather than a top-tier emergency; vendor patches are nonetheless available.
A remotely reachable, unauthenticated out-of-bounds write (buffer overflow, CWE-787) in IBM DataPower Gateway can corrupt memory and potentially allow an attacker to fully compromise the affected appliance, as reflected in the assessed CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with the flaw reachable in the normal network-processing path since no authentication, user interaction, or special configuration is required. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, though the unauthenticated network attack surface and memory-corruption impact make this a genuine high-priority issue for exposed deployments; IBM has published a vendor fix via its support advisory.
Cross-site scripting in the IBM DataPower Gateway 10.6.0 Web UI (builds 10.6.0.0 through 10.6.0.10) lets an unauthenticated attacker inject arbitrary JavaScript that executes in the browser of an operator who is already logged into the appliance management console, potentially leading to credential or session disclosure within that trusted session. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3) confirms the attacker needs no credentials but the victim must interact with attacker-supplied content, so this is a lure-driven, high-impact issue rather than silent mass exploitation; no public exploit has been identified at time of analysis. A vendor patch is available, and only the 10.6.0.x range up to 10.6.0.10 is affected, so upgrading the fixed build removes exposure.
Arbitrary code execution in IBM DataPower Gateway is possible when a user with existing local access to the appliance supplies crafted oversized input to a component that performs improper bounds checking, allowing an out-of-bounds write and, potentially, execution of arbitrary code in the appliance's process context. Affected release trains are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; IBM has published a vendor fix, and no public exploit code was identified at time of analysis. Note that the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8) characterizes this as remotely exploitable without privileges, which is inconsistent with the description's requirement for a local user and with the independent assessment of AV:L/AC:L/PR:L/UI:N - the local-access prerequisite is the practical limiter on real-world risk, while the impact if triggered remains full confidentiality, integrity, and availability loss.
Stack-based buffer overflow in IBM DataPower Gateway firmware tracks 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 allows an authenticated attacker holding administrative-level privileges to execute arbitrary code on the gateway. Exploitation is network reachable but gated by high attack complexity (AC:H), meaning the attacker depends on conditions they cannot fully control, such as a specific memory layout or parsing state, so a single deterministic trigger is not guaranteed; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); IBM has released patched builds via its support advisory.
Out-of-bounds write in IBM DataPower Gateway lets a remote, unauthenticated attacker corrupt memory and potentially execute arbitrary code on affected gateway builds (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2), as reflected in the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 8.1. The PR:N/UI:N components mean no credentials or user interaction are required, so any network-reachable instance on an affected build is exposed, though the AC:H rating indicates exploitation depends on satisfying a non-trivial condition - most likely a specific input state, parsing path, or memory layout - to escalate the write beyond a crash into reliable code execution. Vendor patch data indicates a fix is available from IBM, and no public exploit code or confirmed active exploitation was identified at time of analysis; the EPSS score was not provided in the underlying intelligence, so no probabilistic exploitation estimate can be quoted.
Unauthenticated remote code execution affects IBM DataPower Gateway across multiple release streams - 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 - stemming from an out-of-bounds write (CWE-787) that corrupts memory and can be leveraged to run attacker-controlled code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the flaw is reachable over the network with no authentication and no user interaction, making any internet- or partner-facing DataPower instance running an unpatched build a high-priority target. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; patch available per vendor advisory (IBM support page node/7289775), with the specific fixed firmware builds published there.
IBM DataPower Gateway can be driven into a denial-of-service condition by a remote, unauthenticated attacker who supplies input that reaches a flawed sorting comparator, causing the comparator to violate strict-weak-ordering and triggering an out-of-bounds memory access (CWE-787) that can crash or destabilize the affected service. All builds in the 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 ranges are affected; the impact is confined to availability (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity effect and no privilege gain. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and IBM has published a fix via its support advisory, so this should be treated as a patching-priority availability risk rather than an emergency.
Unauthenticated remote attackers can drive IBM DataPower Gateway into resource exhaustion and denial of service by sending crafted GraphQL queries that abuse improper memoization of fragment spreads. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, and per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector no authentication or user interaction is required once a reachable GraphQL-processing endpoint exists. Impact is confined to availability (no confidentiality or integrity loss), and there is no public exploit identified at time of analysis; exposure depends entirely on whether the gateway has been configured to accept and process GraphQL requests.
Heap-based buffer overflow (CWE-787) in IBM DataPower Gateway allows an unauthenticated remote attacker to crash the gateway and cause a denial of service. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required, so any attacker who can reach a listening interface and deliver a crafted request to the vulnerable parsing path can trigger the fault. The assessed impact is availability-only (A:H, C:N/I:N) rated 8.2 High; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is governed mainly by network exposure of the gateway's listening interfaces. This is a genuine but tier-two priority issue rather than an emergency, with patches available from IBM.
A type confusion flaw (CWE-843) in IBM DataPower Gateway lets a remote, unauthenticated attacker crash a reachable gateway service, producing a denial-of-service condition. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a network-reachable, low-complexity, unauthenticated trigger with availability-only impact. IBM has published a vendor fix via its support advisory, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
Out-of-bounds write in IBM DataPower Gateway lets unauthenticated remote attackers corrupt process memory, resulting in disclosure of sensitive information and denial of service. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with a CVSS 3.1 base score of 8.6 driven by high availability impact alongside limited confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and IBM has made a fix available through its support advisory, so this is a credible operational priority rather than a confirmed emergency - exposure depends on whether the gateway's network listeners are reachable by the attacker.
IBM DataPower Gateway is vulnerable to a remote, unauthenticated denial of service (CVSS 3.1 base 7.5) in which a crafted request triggers an out-of-bounds read, degrading or crashing the affected gateway service. All supported firmware streams in the affected ranges are exposed: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6 (the 10.6 CD stream), and 11.0.0.0 through 11.0.0.2. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms exploitable over the network with no authentication, privileges, or user interaction, but restricts impact to availability - no confidentiality or integrity loss is assessed - so exploitation results in service disruption rather than compromise; there is no public exploit identified at time of analysis, and a vendor patch is available.
Denial of service in IBM DataPower Gateway affects releases 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, where crafted network input reaching the vulnerable parsing path overflows a buffer and can crash the affected service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), exploitation requires no authentication and no user interaction, so any internet- or partner-facing listener that processes malformed input is exposed; impact is availability-only - a crash/restart condition rather than data exposure or code execution. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV), so this is a genuine but bounded operational risk that depends primarily on whether affected listeners are reachable from untrusted networks.
Unauthenticated remote attackers can crash IBM DataPower Gateway by sending a crafted request that triggers a null pointer dereference, resulting in a denial of service that takes the affected service interface offline. All four maintained release trains are affected: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or privileged position is needed - only network reachability to a vulnerable, unpatched gateway - and the sole impact is availability (C:N/I:N/A:H), with no data exposure or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible but bounded availability risk that is governed primarily by how exposed the gateway's service interfaces are to untrusted networks.
An out-of-bounds write in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows an unauthenticated remote attacker to corrupt gateway memory, most reliably causing a denial of service and potentially enabling partial confidentiality or integrity compromise. The flaw carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), and the vector's PR:N/UI:N components confirm no credentials or user interaction are required to reach the vulnerable code - the practical limiting factor is whether the attacker's network can reach a DataPower service listener. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix via IBM Support (node/7289775).
Denial of service in IBM DataPower Gateway lets unauthenticated remote attackers send crafted network traffic that triggers an out-of-bounds write (CWE-787), degrading or halting the gateway's availability. The flaw affects version lines 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, scoring CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with availability-only impact. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but IBM has published a vendor fix, so internet-facing gateways should be treated as the highest-priority upgrade target.
Denial of service in IBM DataPower Gateway (versions 10.5.0, 10.6.0, 10.6cd, and 11.0.0) allows a remote unauthenticated attacker to exhaust system resources due to improper resource limitations (CWE-770), rendering the gateway unavailable. The CVSS 3.1 base score is 7.5 with an availability-only impact (A:H) and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch is available.
Signature forgery in IBM DataPower Gateway lets an authenticated user with valid low-privilege credentials submit signature requests that the appliance processes without properly verifying data authenticity, producing forged signatures that relying parties may accept as genuine. Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; the impact is integrity-only (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with no confidentiality or availability loss. There is no public exploit identified at time of analysis, and IBM has published a vendor fix via its support portal, so this is a moderate-risk authenticated integrity issue rather than a remotely exploitable, unauthenticated critical defect.
Stored/reflected cross-site scripting in the administrative Web UI of IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) lets an authenticated user whose input is rendered back into UI pages embed arbitrary JavaScript that executes in the browser of another, potentially more-privileged user, enabling credential or session disclosure inside the trusted management session. The flaw is not self-executing: it requires a low-privileged authenticated position (PR:L) plus a second victim who views the injected content (UI:R), and there is no public exploit identified at time of analysis, nor is it listed in CISA KEV. At CVSS 5.4 (CWE-79) this is a genuine but non-urgent issue, with realistic risk confined to deployments whose management Web UI is reachable by multiple users of differing privilege levels.
Improper authorization in IBM DataPower Gateway lets a local attacker who already holds a valid low-privileged account read sensitive information that should be restricted from that privilege level. Exposure is limited to specific builds: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6 (10.6CD), and 11.0.0.0 through 11.0.0.2. Exploitation requires local access to the appliance plus authenticated credentials (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so realistic risk is confined to insiders or post-compromise scenarios; CISA SSVC records no known exploitation, no public exploit code is identified at time of analysis, and IBM has published a vendor patch (support node 7289775).
Denial of service in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows a remote unauthenticated attacker to degrade or stall request processing by submitting input that forces worst-case algorithmic complexity during linked-list traversal. Rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), the flaw is an availability-only issue: the CVSS AC:H rating reflects that the attacker must craft input to hit the pathological code path rather than simply flooding the gateway with arbitrary traffic, and impact is confined to service degradation or denial with no confidentiality or integrity effect. No public exploit identified at time of analysis, and a vendor patch is available.
Race condition in IBM DataPower Gateway across three concurrent version lines (10.5.0.x, 10.6.0.x, and 11.0.0.x) permits state contamination of the built-in X-Client-IP header under concurrent request load, enabling IP spoofing and cross-client IP address disclosure. The flaw resides in IBM's enterprise API gateway and integration middleware, commonly deployed in high-throughput service meshes where simultaneous request processing is routine. IBM has released a patch via advisory 7282770, and no public exploit has been identified at time of analysis.
XML External Entity injection in IBM DataPower Gateway 10.5.0, 10.6.0, and 10.6CD allows a privileged authenticated user who can submit XML data to the gateway to either exfiltrate sensitive information from the underlying system or trigger memory exhaustion through recursive or large entity expansion. The vulnerability exists in the gateway's XML processing pipeline, a core function of this API/ESB platform. No public exploit code has been identified at time of analysis, and the vendor has released a patch documented in IBM Security Advisory 7278748.
IBM DataPower Gateway versions 10.5.0.0-10.5.0.20, 10.6.0.0-10.6.0.8, and 10.6.1.0-10.6.5.0 are vulnerable to cross-site request forgery (CSRF) that allows unauthenticated remote attackers to execute unauthorized actions on behalf of trusted users with user interaction. The vulnerability carries a CVSS score of 6.5 with medium real-world risk due to the requirement for user interaction and the integrity-only impact.
IBM DataPower Gateway versions 10.6CD (10.6.1.0-10.6.5.0), 10.5.0 (10.5.0.0-10.5.0.20), and 10.6.0 (10.6.0.0-10.6.0.8) disclose sensitive system information from other domains to authenticated administrative users due to improper access control. The vulnerability requires high-privilege administrative access over the network and results in confidentiality impact only; no public exploit code or active exploitation has been confirmed. CVSS 4.1 reflects low real-world risk due to authentication requirement, though patch availability limits exposure window.