Ibm Datapower Gateway vulnerabilities
81 known vulnerabilities affecting ibm/datapower_gateway.
Total CVEs
81
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL11HIGH40MEDIUM28LOW2
Vulnerabilities
Page 1 of 5
CVE-2026-15762P2CRITICALCVSS 9.8≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-15762 [CRITICAL] CWE-787 CVE-2026-15762: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
nvd
CVE-2026-16340P2CRITICALCVSS 9.8≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16340 [CRITICAL] CWE-787 CVE-2026-16340: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser.
nvd
CVE-2026-14269P2CRITICALCVSS 9.8≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14269 [CRITICAL] CWE-122 CVE-2026-14269: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.
nvd
CVE-2026-14502P2CRITICALCVSS 9.8≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14502 [CRITICAL] CWE-287 CVE-2026-14502: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.
nvd
CVE-2026-14888P2CRITICALCVSS 9.8≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14888 [CRITICAL] CWE-122 CVE-2026-14888: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.
nvd
CVE-2026-14991P3CRITICALCVSS 9.8≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14991 [CRITICAL] CWE-787 CVE-2026-14991: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
nvd
CVE-2026-15784P3HIGHCVSS 8.1≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-15784 [HIGH] CWE-787 CVE-2026-15784: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
nvd
CVE-2026-14992P3CRITICALCVSS 9.8≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14992 [CRITICAL] CWE-787 CVE-2026-14992: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.
nvd
CVE-2026-14988P3CRITICALCVSS 9.8≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14988 [CRITICAL] CWE-125 CVE-2026-14988: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.
nvd
CVE-2026-16163P3HIGHCVSS 8.6≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16163 [HIGH] CWE-787 CVE-2026-16163: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption due to an out-of-bounds write.
nvd
CVE-2026-14497P3HIGHCVSS 8.1≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14497 [HIGH] CWE-347 CVE-2026-14497: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.
nvd
CVE-2026-14905P3HIGHCVSS 8.2≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14905 [HIGH] CWE-611 CVE-2026-14905: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
nvd
CVE-2019-4621P3CRITICALCVSS 9.8≥ 7.6.0.0, ≤ 7.6.0.14≥ 2018.4.1.0, ≤ 2018.4.1.5+4 more2019-12-09
CVE-2019-4621 [CRITICAL] CWE-1188 CVE-2019-4621: IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default admin
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883.
nvd
CVE-2026-14508P3CRITICALCVSS 9.1≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14508 [CRITICAL] CWE-416 CVE-2026-14508: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.
nvd
CVE-2022-31776P3HIGHCVSS 8.8≥ 10.0.1.0, ≤ 10.0.1.8≥ 10.0.2.0, < 10.5.0.1+8 more2022-08-01
CVE-2022-31776 [HIGH] CWE-918 CVE-2022-31776: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 2
nvd
CVE-2026-16181P3HIGHCVSS 7.4≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16181 [HIGH] CWE-285 CVE-2026-16181: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass security restrictions due to improper authorization.
nvd
CVE-2022-31775P3CRITICALCVSS 9.1≥ 10.0.1.0, < 10.0.1.8≥ 10.0.2.0, < 10.5.0.1+8 more2022-08-01
CVE-2022-31775 [CRITICAL] CWE-611 CVE-2022-31775: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228359.
nvd
CVE-2026-16159P3HIGHCVSS 8.6≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16159 [HIGH] CWE-787 CVE-2026-16159: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.
nvd
CVE-2025-36375P3HIGHCVSS 8.8≥ 10.5.0.0, < 10.5.0.21≥ 10.6.0.0, < 10.6.0.9+1 more2026-04-01
CVE-2025-36375 [HIGH] CWE-352 CVE-2025-36375: IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 thr
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the webs
nvd
CVE-2026-15781P3HIGHCVSS 8.0≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-15781 [HIGH] CWE-121 CVE-2026-15781: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
nvd
1 / 5Next →