Loading vulnerability…
Remote Code Execution in IBM DataPower Gateway RFC2047 Parser
CVE-2026-16340 is an out-of-bounds write vulnerability in the RFC2047 encoded-word parser in IBM DataPower Gateway. Processing specially crafted input could allow a remote attacker to corrupt memory and execute arbitrary code. Affected versions are 10.5.0.0–10.5.0.22, 10.6.1–10.6.6, 10.6.0.0–10.6.0.10, and 11.0.0.0–11.0.0.2. The reported CVSS v3.1 score is 9.8, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise the confidentiality, integrity, and availability of an affected gateway through arbitrary code execution. This could expose or alter information accessible to the compromised process and disrupt gateway services. The execution privilege level is not specified.
If you can’t patch tonight, do this now.
No official temporary workaround is documented. Pending patching, restrict gateway access to trusted networks and apply network segmentation to reduce exposure. Monitor malformed traffic, unexpected process crashes, gateway restarts, and repeated service interruptions. These are compensating controls, not a confirmed prevention mechanism for this vulnerability.
Patch, then assume compromise.
Install the applicable IBM security update for CVE-2026-16340. Fixed-release destinations identified for the affected product branches are 10.5.0.23 for 10.5.0.x, 10.6.0.11 for 10.6.0.x, and 11.0.0.3 for both 10.6.1–10.6.6 and 11.0.0.x. Confirm CVE-specific coverage and upgrade requirements in IBM's security bulletin before deployment.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.