Loading vulnerability…
Out-of-bounds write in IBM DataPower Gateway
CVE-2026-16163 is an out-of-bounds write vulnerability in IBM DataPower Gateway that allows a remote attacker to cause memory corruption. Affected versions are 10.5.0.0–10.5.0.22, 10.6.0.0–10.6.0.10, 10.6.1–10.6.6, and 11.0.0.0–11.0.0.2. The vulnerability is rated CVSS 3.1 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. The affected function and triggering input are not publicly specified in the available technical details.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote exploitation can corrupt gateway memory. The CVSS assessment indicates high availability impact and low confidentiality and integrity impacts, making substantial service disruption a principal concern. Arbitrary code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
No official workaround is documented. Pending patching, restrict network access to affected gateways and their management interfaces to trusted sources and use network segmentation to reduce exposure. Monitor unexpected process crashes, gateway restarts, failovers, and repeated service interruptions. These measures reduce exposure or aid detection but are not confirmed to prevent exploitation.
Patch, then assume compromise.
Apply the applicable IBM DataPower Gateway security update. Identified fixed releases are 10.5.0.23 for the 10.5.0 branch, 10.6.0.11 for the 10.6.0 branch, and 11.0.0.3 for the 11.0.0 branch; the identified upgrade destination for affected 10.6CD releases 10.6.1–10.6.6 is 11.0.0.3. Verify release-specific requirements against IBM's security bulletin for CVE-2026-16163.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.