CVE-2026-16163: CWE-787 Out-of-bounds Write in IBM DataPower Gateway 10.6CD

CVE-2026-16163 is an out-of-bounds write vulnerability (CWE-787) affecting multiple versions of IBM DataPower Gateway, specifically versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. This flaw allows a remote attacker to cause memory corruption, potentially impacting the confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability with low impact on confidentiality and integrity. There is no explicit vendor advisory or patch information included in the data.

The vulnerability can be exploited remotely without authentication or user interaction, leading to memory corruption. The impact includes partial loss of confidentiality and integrity, and a high impact on availability, which could result in denial of service or system instability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor IBM's security advisories for updates and consider applying any recommended temporary mitigations provided by IBM.