CVE-2025-36373
Received Received - Intake
Information Disclosure Vulnerability in IBM DataPower Gateway

Publication date: 2026-04-01

Last updated on: 2026-04-06

Assigner: IBM Corporation

Description
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-01
Last Modified
2026-04-06
Generated
2026-06-16
AI Q&A
2026-04-02
EPSS Evaluated
2026-06-15
NVD
CVE-2025-36373
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
ibm datapower_gateway From 10.5.0.0 (inc) to 10.5.0.21 (exc)
ibm datapower_gateway From 10.6.0.0 (inc) to 10.6.0.9 (exc)
ibm datapower_gateway From 10.6.1.0 (inc) to 10.6.6.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects IBM DataPower Gateway versions 10.5.0 through 10.6.5.0. It allows an administrative user to access sensitive system information from other domains within the system, which should normally be isolated.

Impact Analysis

The vulnerability could lead to unauthorized disclosure of sensitive system information across domains to an administrative user. This may increase the risk of information leakage and potentially aid in further attacks or misuse of system data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-36373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart