Loading vulnerability…
Out-of-bounds write in IBM DataPower Gateway
CVE-2026-16159 is an out-of-bounds write vulnerability in IBM DataPower Gateway versions 10.5.0.0–10.5.0.22, 10.6.1–10.6.6, 10.6.0.0–10.6.0.10, and 11.0.0.0–11.0.0.2. A remote, unauthenticated attacker can exploit the flaw to obtain sensitive information and cause denial of service without user interaction. The affected function and triggering input are not identified. The vulnerability has a reported CVSS v3.1 score of 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose sensitive information and severely disrupt gateway availability. The CVSS assessment also indicates low integrity impact, although specific integrity consequences are not described. Arbitrary code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
No official workaround is documented. Pending patching, restrict gateway Web UI and API access to trusted networks and apply network segmentation to reduce exposure. Monitor malformed traffic, unusual payload sizes, process crashes, gateway restarts, and repeated service interruptions. These measures are compensating controls, not confirmed prevention of exploitation.
Patch, then assume compromise.
Upgrade affected 10.5.0 releases to 10.5.0.23, affected 10.6.0 releases to 10.6.0.11, and affected 11.0.0 releases to 11.0.0.3. For affected 10.6CD releases 10.6.1–10.6.6, the identified upgrade destination is 11.0.0.3. Confirm release-specific requirements against the applicable IBM security bulletin before deployment.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.