CVE-2025-36375 is a cross-site request forgery (CWE-352) vulnerability affecting IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.20, 10.6.0.0 through 10.6.0.8, and 10.6.1.0 through 10.6.5.0. The vulnerability allows an attacker to induce an authenticated user to perform unwanted actions on the gateway, potentially leading to unauthorized changes. The CVSS v3.1 base score is 6.5, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

Successful exploitation could result in unauthorized modification of data or configuration on the IBM DataPower Gateway due to the CSRF vulnerability. There is no impact on confidentiality or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is released, consider implementing compensating controls such as validating anti-CSRF tokens in web interfaces or restricting access to trusted networks. Monitor IBM advisories for updates on patches or official mitigations.