Ibm Datapower Gateway vulnerabilities
81 known vulnerabilities affecting ibm/datapower_gateway.
Total CVEs
81
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL11HIGH40MEDIUM28LOW2
Vulnerabilities
Page 2 of 5
CVE-2026-14999P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14999 [HIGH] CWE-347 CVE-2026-14999: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.
nvd
CVE-2026-15824P3HIGHCVSS 8.2≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-15824 [HIGH] CWE-787 CVE-2026-15824: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
nvd
CVE-2026-14496P3HIGHCVSS 8.2≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-14496 [HIGH] CWE-125 CVE-2026-14496: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
nvd
CVE-2019-4294P3HIGHCVSS 7.8fixed in 2018.4.1.7≥ 7.6.0.0, ≤ 7.6.0.15+6 more2019-08-20
CVE-2019-4294 [HIGH] CWE-78 CVE-2019-4294: IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local attacker to execute arbitrary commands on the system, caused by a command injection vulnerability. IBM X-Force ID: 16188.
nvd
CVE-2018-1669P3HIGHCVSS 7.1≥ 7.1.0.0, ≤ 7.1.0.23≥ 7.2.0.0, ≤ 7.2.0.21+5 more2018-09-25
CVE-2018-1669 [HIGH] CWE-611 CVE-2018-1669: IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensiti
nvd
CVE-2026-16179P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16179 [HIGH] CWE-124 CVE-2026-16179: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.
nvd
CVE-2026-16170P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16170 [HIGH] CWE-787 CVE-2026-16170: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
nvd
CVE-2026-16176P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16176 [HIGH] CWE-770 CVE-2026-16176: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation.
nvd
CVE-2026-16178P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16178 [HIGH] CWE-787 CVE-2026-16178: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validation.
nvd
CVE-2018-1421P3HIGHCVSS 7.1≥ 7.1.0.0, ≤ 7.1.0.21≥ 7.2.0.0, ≤ 7.2.0.18+4 more2018-04-04
CVE-2018-1421 [HIGH] CWE-611 CVE-2018-1421: IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML Exter
IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 139023.
nvd
CVE-2026-16167P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16167 [HIGH] CWE-787 CVE-2026-16167: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checking.
nvd
CVE-2026-15822P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-15822 [HIGH] CWE-405 CVE-2026-15822: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads.
nvd
CVE-2026-15819P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-15819 [HIGH] CWE-787 CVE-2026-15819: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to out-of-bounds memory access caused by a strict-weak-ordering violation in a sorting comparator.
nvd
CVE-2026-16165P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16165 [HIGH] CWE-476 CVE-2026-16165: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.
nvd
CVE-2026-16161P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16161 [HIGH] CWE-125 CVE-2026-16161: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
nvd
CVE-2026-16111P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16111 [HIGH] CWE-843 CVE-2026-16111: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.
nvd
CVE-2022-31773P3HIGHCVSS 8.8≥ 10.0.1.0, < 10.5.0≥ 10.0.2.0, < 10.5.0+7 more2022-08-26
CVE-2022-31773 [HIGH] CWE-352 CVE-2022-31773: IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which
IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 228357.
nvd
CVE-2026-16164P3HIGHCVSS 7.5≥ 10.5.0.0, < 10.5.0.23≥ 10.6.0.0, < 10.6.0.11+2 more2026-10-08
CVE-2026-16164 [HIGH] CWE-787 CVE-2026-16164: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a buffer overflow.
nvd
CVE-2021-38872P3HIGHCVSS 7.5≥ 10.0.1.0, ≤ 10.0.1.4≥ 2018.4.1.0, ≤ 2018.4.1.17+6 more2022-05-17
CVE-2021-38872 [HIGH] CVE-2021-38872: IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1
IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a denial of service by consuming resources with multiple requests. IBM X-Force ID: 208348.
nvd
CVE-2020-4994P3HIGHCVSS 7.5≥ 10.0.1.0, ≤ 10.0.1.4≥ 2018.4.1.0, ≤ 2018.4.1.17+4 more2022-05-17
CVE-2020-4994 [HIGH] CVE-2020-4994: IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a rem
IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a temporary denial of service by sending invalid HTTP requests. IBM X-Force ID: 192906.
nvd