CVE-2026-16161

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-15

Assigner: IBM Corporation

Description

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-08

EPSS Evaluated

2026-10-18

NVD

CVE-2026-16161

EUVD

EUVD-2026-94966

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	datapower_gateway	From 11.0.0.0 (inc) to 11.0.0.3 (exc)
ibm	datapower_gateway	From 10.6.1.0 (inc) to 11.0.0.3 (exc)
ibm	datapower_gateway	From 10.6.0.0 (inc) to 10.6.0.11 (exc)
ibm	datapower_gateway	From 10.5.0.0 (inc) to 10.5.0.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. It is caused by an out-of-bounds read, which could allow a remote attacker to disrupt service.

Detection Guidance

This vulnerability is specific to IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. To detect it, check the installed version of IBM DataPower Gateway on your system. If you are running any of the affected versions, the system may be vulnerable to a denial of service due to an out-of-bounds read.

Impact Analysis

If exploited, this vulnerability could cause your IBM DataPower Gateway to become unavailable, leading to service disruptions for users relying on the gateway for network traffic management or security functions.

Compliance Impact

This vulnerability could lead to a denial of service, which may disrupt services handling sensitive data. For GDPR, this could impact availability of personal data processing systems. For HIPAA, it may affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade IBM DataPower Gateway to a version beyond the affected range (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.6, 10.6.0.0-10.6.0.10, 11.0.0.0-11.0.0.2). Apply patches or updates provided by IBM to address the out-of-bounds read issue.

Hi! I’m here to help you understand CVE-2026-16161. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70