Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-16181

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through…

Risk score
54/100
CVSS
7.4 v3.1
Exploit chance (30 days)
0.3%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass security restrictions due to improper authorization.
Affected
Ibm Datapower Gateway
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Ibm Datapower GatewayTHE FLAWSTHE FIXCVE-2026-16181IBM DataPower Gateway10.5.0.0 through 10.5.0.22,10.6.1 through 10.6.6, 10.6.0.0…CVSS 7.4 · EPSS 0%CVE-2026-15762Out-of-bounds write can leadto remote code executionCVSS 9.8 · EPSS 1%CVE-2026-16340Out-of-bounds write can leadto remote code executionCVSS 9.8 · EPSS 0%CVE-2026-14269Heap buffer overflow can leadto remote code executionCVSS 9.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedIbm Datapower GatewayAMBER · PATCH THIS WEEKIbm DatapowerGatewayIBM DataPower Gateway10.5.0.0 through 10.5.0.22, 10.6.1through 10.6.6, 10.6.0.0 through10.6.0.10, and 11.0.0.0 through11.0.0.2 could allow a remoteattacker to execute arbitrarycode due to an out-of-bounds…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-285 (CWE-285)56 other warnings in 30 days →Same productEarlier Ibm Datapower Gateway warnings35 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Ibm Datapower Gateway: Amber, patch this week. IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

The flaws

  • CVE-2026-16181: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through… (CVSS 7.4 · EPSS 0%)
  • CVE-2026-15762: Out-of-bounds write can lead to remote code execution (CVSS 9.8 · EPSS 1%)
  • CVE-2026-16340: Out-of-bounds write can lead to remote code execution (CVSS 9.8 · EPSS 0%)
  • CVE-2026-14269: Heap buffer overflow can lead to remote code execution (CVSS 9.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Ibm Datapower Gateway

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.4 high
  • Remotely exploitable without logging in

References

Original description

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass security restrictions due to improper authorization.

Last activity 8 Oct 2026. Patch Forecast updates every hour.