Description
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.
Published: 2026-10-08
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Disclosure
Action: Upgrade
AI Analysis

Impact

The vulnerability is an out‑of‑bounds read that allows a remote authenticated attacker to obtain sensitive data from IBM DataPower Gateway. The flaw can be triggered by crafted input, causing the processor to read beyond intended memory limits and expose confidential configuration or traffic information.

Affected Systems

Affected systems include IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. Patches are available in later releases: 10.6CD 10.6.611.0.0.3, 10.6.0 10.6.0.11, 11.0.0 11.0.0.21, and 10.5.0 10.5.0.22.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity level. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires remote authenticated access; successful exploitation would compromise confidentiality but is unlikely to lead to code execution or denial of service. Overall risk is moderate, highlighting the importance of applying the vendor’s patch.

Generated by OpenCVE AI on October 8, 2026 at 16:58 UTC.

Remediation

Vendor Solution

IBM strongly advises upgrading as soon as possible. Known Issue: DT499224 https://www.ibm.com/mysupport/s/defect/aCIgJ000000IiH7/dt499224 Affected VersionsFixed in ReleaseIBM DataPower Gateway 10.6CD 10.6.1 - 10.6.611.0.0.3IBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.1010.6.0.11IBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.211.0.0.3IBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.2210.5.0.23

OpenCVE Recommended Actions

  • Upgrade to the latest IBM DataPower Gateway release (e.g., 10.6CD 10.6.611.0.0.3, 10.6.0 10.6.0.11, 11.0.0 11.0.0.21, or 10.5.0 10.5.0.22).
  • Apply IBM security updates as they are released and follow the vendor’s guidance for the DT499224 defect.
  • Restrict administrative and management console access to trusted personnel only.
  • Monitor system logs for anomalous activity that may indicate an attempt to exploit the out‑of‑bounds read.

Generated by OpenCVE AI on October 8, 2026 at 16:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Ibm datapower Gateway
CPEs cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:-:*:*:*
cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:continuous_delivery:*:*:*
Vendors & Products Ibm datapower Gateway

Thu, 08 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.
Title IBM DataPower Gateway Out-of-bounds Read
First Time appeared Ibm
Ibm datapower Gateway 1050
Ibm datapower Gateway 1060
Ibm datapower Gateway 106cd
Ibm datapower Gateway 1100
Weaknesses CWE-125
CPEs cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.22:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datapower Gateway 1050
Ibm datapower Gateway 1060
Ibm datapower Gateway 106cd
Ibm datapower Gateway 1100
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Ibm Datapower Gateway Datapower Gateway 1050 Datapower Gateway 1060 Datapower Gateway 106cd Datapower Gateway 1100
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-08T17:53:34.142Z

Reserved: 2026-07-17T23:28:45.161Z

Link: CVE-2026-16177

cve-icon Vulnrichment

Updated: 2026-10-08T15:28:32.875Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T13:17:15.933

Modified: 2026-10-15T00:03:39.113

Link: CVE-2026-16177

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T21:15:13Z

Weaknesses