Read the docs

IBM

Records9712All Threatist records
Exploited (KEV)11In CISA KEV
CVSS critical986CVSS 9.0–10.0
CVSS high2776CVSS 7.0–8.9

Exploited now

IBM records in CISA KEV

Components

Products in the NVD configurations · select one to filter the records

Records

81 records in Datapower Gateway · all components

Priority MEDIUM 49

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00489 Published 2026-10-08 No fix listed CWE-787
Priority MEDIUM 49

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00527 Published 2026-10-08 No fix listed CWE-787
TI-2026-69396 CVE-2026-14992 · GHSA-3m79-9w2v-h4h8

Out-of-bounds write in IBM DataPower Gateway

Priority MEDIUM 49

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00318 Published 2026-10-08 No fix listed CWE-787
Priority MEDIUM 49

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject em…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00397 Published 2026-10-08 No fix listed CWE-287
Priority MEDIUM 49

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00486 Published 2026-10-08 No fix listed CWE-122
Priority MEDIUM 43

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption due to an out-of-bounds write.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00273 Published 2026-10-08 No fix listed CWE-787
Priority MEDIUM 43

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of servi…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00279 Published 2026-10-08 No fix listed CWE-787
Priority MEDIUM 43

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00417 Published 2026-10-08 No fix listed CWE-787
Priority MEDIUM 43

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overfl…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00381 Published 2026-10-08 No fix listed CWE-122
Priority MEDIUM 42

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer ove…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00326 Published 2026-10-08 No fix listed CWE-787
TI-2026-69393 CVE-2026-14988 · GHSA-2ffc-9jmm-wqfj

Out-of-bounds read in IBM DataPower Gateway

Priority MEDIUM 42

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00257 Published 2026-10-08 No fix listed CWE-125
Priority MEDIUM 42

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00339 Published 2026-10-08 No fix listed CWE-611
Priority MEDIUM 42

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01278 Published 2022-07-31 No fix listed CWE-611
Priority MEDIUM 41

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer ove…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00295 Published 2026-10-08 No fix listed CWE-125
Priority MEDIUM 40

IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00549 Published 2026-07-30 No fix listed CWE-770
Priority MEDIUM 40

IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00924 Published 2018-12-20 No fix listed CWE-352
Priority LOW 39

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the servi…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00324 Published 2026-10-08 No fix listed CWE-124
TI-2026-69415 CVE-2026-16178 · GHSA-wv6r-g2f4-mjm7

IBM DataPower Gateway Out-of-bounds Write

Priority LOW 39

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validati…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00386 Published 2026-10-08 No fix listed CWE-787
TI-2026-69413 CVE-2026-16176 · GHSA-645j-3fmg-jcf5

Denial of service in IBM DataPower Gateway

Priority LOW 39

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00386 Published 2026-10-08 No fix listed CWE-770
Priority LOW 39

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00392 Published 2026-10-08 No fix listed CWE-787
Priority LOW 39

IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00386 Published 2026-10-08 No fix listed CWE-400
Priority LOW 39

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checkin…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00327 Published 2026-10-08 No fix listed CWE-787
Priority LOW 39

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer derefere…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00313 Published 2026-10-08 No fix listed CWE-476
Priority LOW 39

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a buffer overflow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00332 Published 2026-10-08 No fix listed CWE-787
Load more
Open these records in search →