CVE-2026-15784

Summary

A remote attacker can execute arbitrary code on IBM DataPower Gateway devices through an out-of-bounds write vulnerability in versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. This allows for complete system compromise with high impact.

Exploitability

Exploitation requires a remote network connection to the DataPower Gateway service with no authentication required, making it relatively easy to exploit with minimal preconditions.

Blast radius

If exploited, this vulnerability could allow attackers to gain full control over affected DataPower Gateway devices, potentially enabling them to intercept, modify, or redirect traffic through these critical network security appliances.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM DataPower Gateway 10.5.0.23, 10.6.7, 10.6.0.11, or 11.0.0.3 to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.