Information Disclosure Vulnerability in IBM DataPower Gateway

Publication date: 2026-04-01

Last updated on: 2026-04-06

Assigner: IBM Corporation

Description

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-01

Last Modified

2026-04-06

Generated

2026-07-06

AI Q&A

2026-04-02

EPSS Evaluated

2026-07-05

NVD

CVE-2025-36373

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	datapower_gateway	From 10.5.0.0 (inc) to 10.5.0.21 (exc)
ibm	datapower_gateway	From 10.6.0.0 (inc) to 10.6.0.9 (exc)
ibm	datapower_gateway	From 10.6.1.0 (inc) to 10.6.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-497	The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

Executive Summary

This vulnerability affects IBM DataPower Gateway versions 10.5.0 through 10.6.5.0. It allows an administrative user to access sensitive system information from other domains within the system, which should normally be isolated.

Impact Analysis

The vulnerability could lead to unauthorized disclosure of sensitive system information across domains to an administrative user. This may increase the risk of information leakage and potentially aid in further attacks or misuse of system data.

Hi! I’m here to help you understand CVE-2025-36373. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70