CVE-2026-16159

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-15

Assigner: IBM Corporation

Description

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-08

EPSS Evaluated

2026-10-18

NVD

CVE-2026-16159

EUVD

EUVD-2026-94967

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	datapower_gateway	From 11.0.0.0 (inc) to 11.0.0.3 (exc)
ibm	datapower_gateway	From 10.6.1.0 (inc) to 11.0.0.3 (exc)
ibm	datapower_gateway	From 10.6.0.0 (inc) to 10.6.0.11 (exc)
ibm	datapower_gateway	From 10.5.0.0 (inc) to 10.5.0.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 are vulnerable to an out-of-bounds write issue. This flaw could allow a remote attacker to gain access to sensitive information and disrupt service availability.

Detection Guidance

Detection of this vulnerability requires checking the version of IBM DataPower Gateway installed on your system. Compare the installed version against the affected versions (10.5.0.0-10.5.0.22, 10.6.1-10.6.6, 10.6.0.0-10.6.0.10, 11.0.0.0-11.0.0.2). Use commands like 'show version' in the DataPower CLI or check the version via the web management interface.

Impact Analysis

An attacker could exploit this vulnerability to read sensitive data from the system or cause the DataPower Gateway to crash, leading to service disruption. This may result in unauthorized access to confidential information or downtime for critical network services.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance penalties if sensitive data is compromised due to this flaw.

Mitigation Strategies

Update IBM DataPower Gateway to a version beyond the affected range (10.5.0.22, 10.6.6, 10.6.0.10, or 11.0.0.2). If immediate update is not possible, restrict network access to the device and monitor for unusual activity.

Hi! I’m here to help you understand CVE-2026-16159. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70