Description
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.
Published: 2026-10-08
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a heap buffer underwrite flaw that may cause the gateway service to crash. The primary consequence is a service outage, impacting availability of integrated applications. The weakness is recognized as a classic buffer underwrite (CWE-124).

Affected Systems

Affected releases include IBM DataPower Gateway 10.5.0.0‑10.5.0.22, 10.6.0.0‑10.6.0.10, 10.6.1‑10.6.6, and 11.0.0.0‑11.0.0.2. Fixed versions begin at 10.5.0.23, 10.6.0.11, 10.6CD 10.6.1 and later, and 11.0.0.21.

Risk and Exploitability

The CVSS score of 7.5 classifies this issue as high severity. EPSS information is not available, so the likelihood of exploitation cannot be quantified, but the vulnerability can be triggered by sending crafted input to the gateway over the network. It is not listed in the CISA KEV catalog, indicating no publicly known exploits currently. Correcting the flaw requires a patch; attempts to mitigate without a fix provide no benefit other than preventing the crash.

Generated by OpenCVE AI on October 8, 2026 at 17:31 UTC.

Remediation

Vendor Solution

IBM strongly advises upgrading as soon as possible. Known Issue: DT499224 https://www.ibm.com/mysupport/s/defect/aCIgJ000000IiH7/dt499224 Affected VersionsFixed in ReleaseIBM DataPower Gateway 10.6CD 10.6.1 - 10.6.611.0.0.3IBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.1010.6.0.11IBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.211.0.0.3IBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.2210.5.0.23

OpenCVE Recommended Actions

  • Upgrade to a fixed release of IBM DataPower Gateway such as 10.6CD 10.6.1 or later, 10.6.0.11, 11.0.0.21, or 10.5.0.23.
  • Limit exposure of the gateway to trusted networks and enforce strong authentication to reduce the chance that an attacker can send malicious data.
  • Enable detailed logging and monitor for unexpected service restarts or memory errors, setting alerts for potential exploitation attempts.

Generated by OpenCVE AI on October 8, 2026 at 17:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Ibm datapower Gateway
CPEs cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:-:*:*:*
cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:continuous_delivery:*:*:*
Vendors & Products Ibm datapower Gateway

Thu, 08 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.
Title IBM DataPower Gateway Buffer Underwrite
First Time appeared Ibm
Ibm datapower Gateway 1050
Ibm datapower Gateway 1060
Ibm datapower Gateway 106cd
Ibm datapower Gateway 1100
Weaknesses CWE-124
CPEs cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.22:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datapower Gateway 1050
Ibm datapower Gateway 1060
Ibm datapower Gateway 106cd
Ibm datapower Gateway 1100
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ibm Datapower Gateway Datapower Gateway 1050 Datapower Gateway 1060 Datapower Gateway 106cd Datapower Gateway 1100
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-08T14:06:55.054Z

Reserved: 2026-07-17T23:41:07.071Z

Link: CVE-2026-16179

cve-icon Vulnrichment

Updated: 2026-10-08T14:06:49.407Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T13:17:16.200

Modified: 2026-10-15T00:03:15.217

Link: CVE-2026-16179

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T17:45:19Z

Weaknesses
  • CWE-124

    Buffer Underwrite ('Buffer Underflow')