IBM DataPower Gateway: Out-of-bounds write with information disclosure and DoS
Summary
Multiple IBM DataPower Gateway versions in the 10.5.0, 10.6.0, 10.6CD and 11.0.0 branches contain an out-of-bounds write (CWE-787). A remote attacker can exploit it over the network without authentication and with low complexity to obtain sensitive information and cause a denial of service. The impact is mainly availability, with a limited confidentiality impact.
Affected
- IBM DataPower Gateway 10.5.0.0 to 10.5.0.22
- IBM DataPower Gateway 10.6.0.0 to 10.6.0.10
- IBM DataPower Gateway 10.6.1 to 10.6.6 (10.6CD)
- IBM DataPower Gateway 11.0.0.0 to 11.0.0.2
Fixed in
- 10.5.0.23 for the 10.5.0 branch
- 10.6.0.11 for the 10.6.0 branch
- 11.0.0.3 for the 11.0.0 branch and for 10.6CD (10.6.1 to 10.6.6)
Workaround
Unknown. IBM has not specified a workaround; patching is the primary fix. Until patching is possible, restrict access to API and management listeners to necessary networks.
Exploitation
- No known exploitation in the source data.
- CISA SSVC: Exploitation none, automatable yes.
- Not listed as known exploited in the source snapshot; verify in the CISA KEV catalog.
- EPSS 0.00273; no public proof of concept found.
Our recommendation
- Check whether any DataPower instance runs an affected version.
- Patch to the fixed release for your branch, starting with internet-facing gateways.
- Patch together with the other CVEs in the same IBM bulletin, some of which are rated higher.
- Restrict management and API listeners and monitor gateways for crashes or unusual traffic.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin node 7289775 www.ibm.com
- Rapid7 via Vulners: CVE-2026-16159 vulners.com
- CVE fix data (cve.imfht.com) cve.imfht.com
- Strix: CVE-2026-16159 www.strix.ai
- Red Packet Security: CVE-2026-16159 www.redpacketsecurity.com
- SecurityOnline: IBM DataPower Gateway vulnerabilities securityonline.info
- CIRCL via Vulners: CVE-2026-16159 (EPSS) vulners.com
- threatint CVE-2026-16159 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:06.
Original description (NVD)
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.