CVE-2025-36374 describes an XML External Entity (XXE) injection vulnerability in IBM DataPower Gateway version 10.6.1. The vulnerability arises from improper restriction of XML external entity references (CWE-611) during XML data processing. A privileged user could exploit this flaw to disclose sensitive information or consume memory resources, impacting confidentiality and availability. The CVSS 3.1 base score is 5.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Exploitation of this vulnerability could lead to exposure of sensitive information and denial of service through memory resource exhaustion. The attacker must have privileged access to the system. The impact affects confidentiality and availability but not integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict privileged user access and carefully validate XML inputs to mitigate potential exploitation.