CVE-2026-15819: CWE-787 Out-of-bounds Write in IBM DataPower Gateway 10.6CD

IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2 contain a vulnerability identified as CVE-2026-15819. The issue is an out-of-bounds write resulting from a strict-weak-ordering violation in a sorting comparator component. This memory corruption flaw can be exploited remotely to cause a denial of service (DoS) without requiring authentication or user interaction. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Successful exploitation of this vulnerability allows a remote attacker to cause a denial of service on affected IBM DataPower Gateway systems by triggering out-of-bounds memory writes. This results in service disruption but does not impact confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the input data. Until a patch is available, consider limiting network exposure of affected systems and monitoring for anomalous behavior related to sorting operations if feasible.