Description
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption due to an out-of-bounds write.
Published: 2026-10-08
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution through memory corruption
Action: Immediate Patch
AI Analysis

Impact

An out‑of‑bounds write flaw allows a remote attacker to corrupt memory on the DataPower Gateway appliance. The vulnerability can lead to arbitrary code execution or system crash, compromising confidentiality, integrity, and availability of the device and potentially the services it manages.

Affected Systems

IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2 are affected. Fixed releases include IBM DataPower Gateway 10.6CD 10.6.1–10.6.6.1.0.3, 10.6.0 10.6.0.0–10.6.0.1010.6.0.11, 10.5.0 10.5.0.0–10.5.0.2210.5.0.23, and 11.0.0 11.0.0.0–11.0.0.211.0.0.3.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network access to the appliance. If exploited, the attacker could gain code execution privileges on the device. Given its high impact and the remote nature, the risk is considered high, warranting prompt remediation.

Generated by OpenCVE AI on October 8, 2026 at 16:55 UTC.

Remediation

Vendor Solution

IBM strongly advises upgrading as soon as possible. Known Issue: DT499224 https://www.ibm.com/mysupport/s/defect/aCIgJ000000IiH7/dt499224 Affected VersionsFixed in ReleaseIBM DataPower Gateway 10.6CD 10.6.1 - 10.6.611.0.0.3IBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.1010.6.0.11IBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.211.0.0.3IBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.2210.5.0.23

OpenCVE Recommended Actions

  • Upgrade to a fixed DataPower Gateway release such as 10.6CD 10.6.1.0.3 or later for 10.6CD, 10.6.0.11 or later for 10.6.0, 11.0.0.3 or later for 11.0.0, and 10.5.0.23 or later for 10.5.0.
  • Restrict or disable remote management interfaces that are unnecessary, limiting exposure to potential attackers.
  • Implement firewall rules or network segmentation to restrict access to the DataPower Gateway to trusted administrative networks.

Generated by OpenCVE AI on October 8, 2026 at 16:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Ibm datapower Gateway
CPEs cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:-:*:*:*
cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:continuous_delivery:*:*:*
Vendors & Products Ibm datapower Gateway

Fri, 09 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption due to an out-of-bounds write.
Title IBM DataPower Gateway Out-of-bounds Write
First Time appeared Ibm
Ibm datapower Gateway 1050
Ibm datapower Gateway 1060
Ibm datapower Gateway 106cd
Ibm datapower Gateway 1100
Weaknesses CWE-787
CPEs cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.22:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datapower Gateway 1050
Ibm datapower Gateway 1060
Ibm datapower Gateway 106cd
Ibm datapower Gateway 1100
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Ibm Datapower Gateway Datapower Gateway 1050 Datapower Gateway 1060 Datapower Gateway 106cd Datapower Gateway 1100
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-08T15:49:55.327Z

Reserved: 2026-07-17T21:48:24.565Z

Link: CVE-2026-16163

cve-icon Vulnrichment

Updated: 2026-10-08T15:49:36.895Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T14:16:53.200

Modified: 2026-10-15T00:00:33.547

Link: CVE-2026-16163

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T18:15:14Z

Weaknesses