IBM DataPower Gateway: Buffer overflow allows code execution by authenticated attacker
Summary
IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.1 to 10.6.6, 10.6.0.0 to 10.6.0.10 and 11.0.0.0 to 11.0.0.2 contain a stack-based buffer overflow (CWE-121). A remote attacker with valid credentials and high privileges could execute arbitrary code on the gateway, which can lead to full compromise of confidentiality, integrity and availability. Exploitation requires high attack complexity and a scope change, according to the CVSS vector.
Affected
- IBM DataPower Gateway 10.5.0.0 through 10.5.0.22
- IBM DataPower Gateway 10.6.1 through 10.6.6 (10.6CD)
- IBM DataPower Gateway 10.6.0.0 through 10.6.0.10
- IBM DataPower Gateway 11.0.0.0 through 11.0.0.2
Fixed in
- 11.0.0.0 to 11.0.0.2: upgrade to 11.0.0.3
- 10.6.0.0 to 10.6.0.10: upgrade to 10.6.0.11
- 10.5.0.0 to 10.5.0.22: upgrade to 10.5.0.23 (per CNA record; verify on IBM bulletin)
- 10.6.1 to 10.6.6 (10.6CD): fixed version unknown from research; verify on IBM bulletin
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found; not listed as known exploited in the sources reviewed.
- VulDB states that no technical details or exploit are publicly available.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
Our recommendation
- Upgrade to the fixed versions listed by IBM as soon as possible; patch together with the other CVEs in the same IBM bulletin, notably CVE-2026-14269.
- Check whether any DataPower instance is exposed to the internet and treat such instances as higher priority.
- Restrict and review accounts with authenticated access to management and admin interfaces, remove unused accounts.
- Monitor authentication logs for unusual activity until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin: IBM DataPower Gateway affected by multiple CVEs www.ibm.com
- IBM Security Bulletin: IBM DataPower Gateway buffer overflow (CVE-2026-15781) www.ibm.com
- VulDB CVE-2026-15781 vuldb.com
- Rapid7 via Vulners: CVE-2026-14269 vulners.com
- Strix: CVE-2026-15781 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:30.
Original description (NVD)
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.