CVE-2026-15784: CWE-787 Out-of-bounds Write in IBM DataPower Gateway 10.6CD

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain an out-of-bounds write vulnerability (CWE-787) that could be exploited remotely to execute arbitrary code. The vulnerability is remotely exploitable without privileges or user interaction, but requires high attack complexity. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, high complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on affected IBM DataPower Gateway systems, potentially leading to full system compromise. The impact includes complete loss of confidentiality, integrity, and availability of the affected system. There are no reports of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor IBM security advisories for updates. Until a fix is available, consider limiting network exposure of affected systems and applying any recommended temporary mitigations from IBM.