The vulnerability is an out‑of‑bounds write in IBM DataPower Gateway that triggers a heap buffer overflow when accessed remotely, causing the appliance to crash or become unresponsive. This memory corruption falls under CWE‑787 and results in a denial of service, disrupting network services and business processes.

Affected products include IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. The flaw can be exploited on any device running those releases, regardless of location.

The CVSS score of 7.5 indicates a high severity, and while the EPSS score is not available, the lack of a KEV listing suggests no widespread known exploits yet. Nevertheless, the remote nature of the attack and the potential for complete service disruption make it a critical risk. The attacker would need network access to the appliance's management interface or exposed service ports to trigger the overflow.