Loading vulnerability…
Remote denial of service in IBM DataPower Gateway
CVE-2026-16167 is an improper bounds-checking vulnerability in IBM DataPower Gateway affecting versions 10.5.0.0–10.5.0.22, 10.6.1–10.6.6, 10.6.0.0–10.6.0.10, and 11.0.0.0–11.0.0.2. A remote attacker can exploit the flaw to cause denial of service. The affected function, triggering input, and precise memory-access error have not been specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disrupt the availability of an affected IBM DataPower Gateway instance and potentially interrupt API traffic handled by that instance. The scope and duration of disruption are unspecified. Code execution and information disclosure are not established impacts of this vulnerability.
If you can’t patch tonight, do this now.
No official workaround is documented. As compensating controls, restrict DataPower Web UI and API access to trusted networks, segment gateway deployments, and monitor for anomalous process crashes, gateway restarts, service failovers, malformed traffic, and repeated service interruptions. These measures are not confirmed to prevent exploitation and do not replace the security updates.
Patch, then assume compromise.
Apply the applicable IBM DataPower Gateway security updates: upgrade affected 10.5.0 releases to 10.5.0.23, affected 10.6.0 releases to 10.6.0.11, and affected 11.0.0 releases to 11.0.0.3. For affected 10.6CD releases 10.6.1–10.6.6, the identified upgrade destination is 11.0.0.3. Confirm release-specific requirements in the applicable IBM security bulletin.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.