CVE-2026-15781: CWE-121 Stack-based buffer overflow in IBM DataPower Gateway 10.6CD

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a stack-based buffer overflow vulnerability (CWE-121) that can be exploited by a remote authenticated attacker to execute arbitrary code. The vulnerability has a CVSS v3.1 base score of 8.0 with attack vector network, high attack complexity, high privileges required, no user interaction, and impacts confidentiality, integrity, and availability with a scope change.

Successful exploitation of this vulnerability could allow a remote authenticated attacker to execute arbitrary code on the affected IBM DataPower Gateway devices, potentially leading to full compromise of the system, including unauthorized disclosure, modification, or destruction of data and disruption of service.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, limit access to the affected systems to trusted users only and monitor for suspicious activity involving authenticated sessions.