CVE-2026-16181: CWE-285 Improper Authorization in IBM DataPower Gateway 10.6CD

IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2 contain an improper authorization vulnerability (CWE-285) that could allow remote attackers to bypass security restrictions. This flaw affects the authorization logic, potentially enabling unauthorized access to protected resources or functions. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, impacting confidentiality and integrity but not availability.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information or unauthorized modification of data within the IBM DataPower Gateway environment. The confidentiality and integrity of the system are at risk, but availability is not impacted. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected IBM DataPower Gateway versions and monitor for unusual access attempts. Follow IBM's security advisories for updates on patches or workarounds.