IBM DataPower Gateway products from version 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 are vulnerable to XML External Entity injection. The flaw allows a remote attacker to craft XML documents that reference external entities, enabling the gateway to retrieve arbitrary external resources or read local files, thereby exposing sensitive data. It may also cause excessive memory consumption, potentially degrading performance or leading to denial of service.

IBM DataPower Gateway versions 10.5.x (10.5.0.0–10.5.0.22), 10.6.x (10.6.0.0–10.6.0.10, 10.6.1–10.6.6), and 11.0.x (11.0.0.0–11.0.0.2). The vendors affected are IBM, with the product series DataPower Gateway.

The CVSS score of 8.2 indicates high severity, yet the EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote, through any network interface that accepts XML data for processing by the gateway. An attacker can trigger the vulnerability by transmitting a crafted XML payload, which the gateway processes without adequate validation.