Loading vulnerability…
Remote Code Execution in IBM DataPower Gateway via Out-of-Bounds Write
CVE-2026-15784 is an out-of-bounds write vulnerability in IBM DataPower Gateway affecting versions 10.5.0.0–10.5.0.22, 10.6.1–10.6.6, 10.6.0.0–10.6.0.10, and 11.0.0.0–11.0.0.2. An unauthenticated remote attacker could exploit the memory-safety flaw to execute arbitrary code. Exploitation has high attack complexity and requires no user interaction. The vulnerable function and precise triggering input are not identified. The vulnerability has a CVSS v3.1 score of 8.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise the confidentiality, integrity, and availability of the affected gateway through arbitrary code execution. Potential consequences include disclosure or modification of information accessible to the compromised process and disruption of gateway services. The execution privilege level is not specified.
If you can’t patch tonight, do this now.
No official workaround is documented. Pending patching, restrict gateway management and API access to trusted networks and apply network segmentation to reduce exposure. Monitor unexpected process crashes, gateway restarts, service failovers, and anomalous traffic. These are compensating controls, not confirmed methods for preventing exploitation.
Patch, then assume compromise.
Install the applicable IBM DataPower Gateway security update: upgrade 10.5.0.0–10.5.0.22 to 10.5.0.23, 10.6.0.0–10.6.0.10 to 10.6.0.11, and 11.0.0.0–11.0.0.2 to 11.0.0.3. For the affected 10.6CD releases 10.6.1–10.6.6, the identified upgrade destination is 11.0.0.3. Confirm release-specific requirements in the applicable IBM security bulletin before deployment.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.