Loading vulnerability…
Remote Denial of Service via Out-of-Bounds Read in IBM DataPower Gateway
CVE-2026-16161 is an out-of-bounds read vulnerability in IBM DataPower Gateway affecting versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. Remote exploitation can cause denial of service. The affected function and triggering input are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disrupt the availability of an affected IBM DataPower Gateway instance and the services that depend on it. Information disclosure, code execution, and integrity impacts are not established for this vulnerability.
If you can’t patch tonight, do this now.
No official workaround is documented. As interim exposure-reduction measures, restrict DataPower Web UI and API access to trusted networks and apply network segmentation. Monitor for anomalous process crashes, gateway restarts, repeated service interruptions, and unexpected failovers. These measures are not confirmed to prevent exploitation and do not replace patching.
Patch, then assume compromise.
Upgrade affected 10.5.0 installations to 10.5.0.23 and affected 10.6.0 installations to 10.6.0.11. Upgrade affected 10.6CD releases 10.6.1 through 10.6.6 and affected 11.0.0 installations to 11.0.0.3. Consult the applicable IBM security bulletin for release-specific installation requirements.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.