Loading vulnerability…
Authenticated remote code execution in IBM DataPower Gateway
CVE-2026-15781 is a stack-based buffer overflow in IBM DataPower Gateway that could allow a remote authenticated attacker to execute arbitrary code. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. The vulnerable function and triggering input are not specified. The CVSS v3.1 score is 8.0, with vector AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise the confidentiality, integrity, and availability of the affected gateway through arbitrary code execution. The CVSS assessment indicates high impacts in all three categories and changed scope, meaning consequences may extend beyond the vulnerable component's security authority. The execution identity and precise downstream effects are not specified.
If you can’t patch tonight, do this now.
No official workaround is documented. As compensating controls pending patching, restrict DataPower Web UI and API access to trusted networks and segment gateway access. Monitor for anomalous process crashes, gateway restarts, service failovers, malformed traffic, and unusual payload sizes. These measures do not eliminate the vulnerability or replace the update.
Patch, then assume compromise.
Install the applicable IBM fixed release: upgrade 10.5.0.0–10.5.0.22 to 10.5.0.23; 10.6.0.0–10.6.0.10 to 10.6.0.11; and 11.0.0.0–11.0.0.2 to 11.0.0.3. The identified upgrade destination for the affected 10.6CD releases, 10.6.1–10.6.6, is 11.0.0.3. Confirm release-specific requirements in IBM's security bulletin before deployment.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.