CVE-2026-13257: CWE-345 Insufficient Verification of Data Authenticity in IBM DataPower Gateway 10.6CD

IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2 contain a CWE-345 Insufficient Verification of Data Authenticity vulnerability. This flaw allows an authenticated user to forge signature requests because the product does not properly verify the authenticity of data. The vulnerability is identified as CVE-2026-13257 with a CVSS 3.1 score of 6.5 (medium severity). No known exploits in the wild have been reported, and no vendor advisory or patch information is provided in the input data.

An authenticated user could exploit this vulnerability to forge signature requests, potentially impacting the integrity of the system by allowing unauthorized actions that rely on signature validation. There is no indication of confidentiality or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's security advisories for updates. Until a fix is available, limit authenticated user privileges to reduce risk.