CVE-2025-36375 — Cross-Site Request Forgery in IBM Datapower Gateway

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
8.8HIGHNVD
CNA6.5
EPSS
0.0%
top 96.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
IBM Datapower GatewayIBM Datapower Gateway 10.5.0IBM Datapower Gateway 10.6.0+1 more
Timeline
PublishedApr 1
Latest updateApr 2

Description

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶NVDibm/datapower_gateway10.5.0.0 — 10.5.0.21+2
▶CVEListV5ibm/datapower_gateway_10.5.010.5.0.0 — 10.5.0.20
▶CVEListV5ibm/datapower_gateway_10.6.010.6.0.0 — 10.6.0.8
▶CVEListV5ibm/datapower_gateway_10.6cd10.6.1.0 — 10.6.5.0

🔴Vulnerability Details

2
GHSA
GHSA-558v-r8m2-hmjm: IBM DataPower Gateway 10↗2026-04-02
▶
CVEList
IBM DataPower Gateway vulnerable to CSRF↗2026-04-01
▶
CVE-2025-36375 — Cross-Site Request Forgery in IBM | cvebase