CVE-2026-16177

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-15

Assigner: IBM Corporation

Description

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-08

EPSS Evaluated

2026-10-18

NVD

CVE-2026-16177

EUVD

EUVD-2026-94890

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	datapower_gateway	From 11.0.0.0 (inc) to 11.0.0.3 (exc)
ibm	datapower_gateway	From 10.6.1.0 (inc) to 11.0.0.3 (exc)
ibm	datapower_gateway	From 10.6.0.0 (inc) to 10.6.0.11 (exc)
ibm	datapower_gateway	From 10.5.0.0 (inc) to 10.5.0.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. A remote authenticated attacker could exploit this to obtain sensitive information.

Detection Guidance

This vulnerability is specific to IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. Detection requires checking the installed version of IBM DataPower Gateway on your system.

Impact Analysis

If you use an affected version of IBM DataPower Gateway, a remote attacker with authentication could read sensitive data that should be protected. This could lead to unauthorized access to confidential information.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, which may violate GDPR, HIPAA, or other regulations requiring protection of personal or health information. Compliance could be impacted if sensitive data is exposed.

Mitigation Strategies

Update IBM DataPower Gateway to a patched version beyond the affected ranges (10.5.0.22, 10.6.6, 10.6.0.10, 11.0.0.2). If immediate patching is not possible, restrict network access to the gateway and monitor for unusual activity.

Hi! I’m here to help you understand CVE-2026-16177. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70