CVE-2026-16177: CWE-125 Out-of-bounds Read in IBM DataPower Gateway 10.6CD

CVE-2026-16177 is a vulnerability classified as CWE-125 (Out-of-bounds Read) affecting multiple versions of IBM DataPower Gateway. The affected versions include 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. The vulnerability allows a remote attacker with authentication to read memory outside the intended bounds, potentially exposing sensitive information. The CVSS v3.1 base score is 5.3, indicating a medium severity impact primarily on confidentiality. There is no indication of integrity or availability impact. No known exploits in the wild have been reported, and no patch or remediation information is provided in the source data.

A remote authenticated attacker could exploit this out-of-bounds read vulnerability to obtain sensitive information from affected IBM DataPower Gateway versions. The impact is limited to confidentiality loss, with no direct impact on integrity or availability. The medium severity rating reflects the moderate risk posed by this information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's security advisories for updates. Until a fix is available, restrict remote authenticated access to trusted users only and apply standard access controls to limit exposure.