Description
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.
Published: 2026-10-08
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

A null pointer dereference was discovered in IBM DataPower Gateway firmware. The flaw enables an unauthenticated remote attacker to trigger a segmentation fault that brings the gateway process to a halt, causing the device to become non‑responsive. This is a classic null pointer reference problem classified as CWE‑476. The impact is limited to availability and does not compromise data confidentiality or integrity.

Affected Systems

IBM reported the defect for several DataPower Gateway releases: 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. The vulnerability is fixed in firmware releases 10.6.1 (10.6CD) and newer, 10.6.0.11 and newer, 11.0.0.2 and newer, and 10.5.0.23 and newer. Devices running earlier revisions remain vulnerable. The affected vendor is IBM and the product is DataPower Gateway.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity with medium‑to‑high exploitability. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote, requiring network access to the device’s management or service interfaces. A remote attacker could repeatedly force the gateway into a DoS state, which remains a valuable tactic for disruptive attacks.

Generated by OpenCVE AI on October 8, 2026 at 16:54 UTC.

Remediation

Vendor Solution

IBM strongly advises upgrading as soon as possible. Known Issue: DT499224 https://www.ibm.com/mysupport/s/defect/aCIgJ000000IiH7/dt499224 Affected VersionsFixed in ReleaseIBM DataPower Gateway 10.6CD 10.6.1 - 10.6.611.0.0.3IBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.1010.6.0.11IBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.211.0.0.3IBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.2210.5.0.23

OpenCVE Recommended Actions

  • Update the DataPower Gateway to the latest fixed firmware version (10.6.1 or later for 10.6CD, 10.6.0.11 or later, 11.0.0.2 or later, or 10.5.0.23 or later).
  • Restrict external administrative access to the device by configuring firewall rules or VPN to allow only trusted IP addresses until the patch is applied.
  • Continuously monitor gateway logs for unexpected restarts or errors that may indicate a denial‑of‑service attempt, and respond promptly when such events occur.

Generated by OpenCVE AI on October 8, 2026 at 16:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Ibm datapower Gateway
CPEs cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:-:*:*:*
cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:continuous_delivery:*:*:*
Vendors & Products Ibm datapower Gateway

Sat, 10 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.
Title IBM DataPower Gateway NULL Pointer Dereference
First Time appeared Ibm
Ibm datapower Gateway 1050
Ibm datapower Gateway 1060
Ibm datapower Gateway 106cd
Ibm datapower Gateway 1100
Weaknesses CWE-476
CPEs cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.22:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datapower Gateway 1050
Ibm datapower Gateway 1060
Ibm datapower Gateway 106cd
Ibm datapower Gateway 1100
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ibm Datapower Gateway Datapower Gateway 1050 Datapower Gateway 1060 Datapower Gateway 106cd Datapower Gateway 1100
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-10T03:02:11.387Z

Reserved: 2026-07-17T21:59:19.880Z

Link: CVE-2026-16165

cve-icon Vulnrichment

Updated: 2026-10-10T03:02:07.391Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T14:16:53.557

Modified: 2026-10-14T23:59:50.617

Link: CVE-2026-16165

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T21:15:13Z

Weaknesses