IBM Datapower Gateway 1060
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in IBM Datapower Gateway 1060.
By the Year
In 2026 there have been 43 vulnerabilities in IBM Datapower Gateway 1060 with an average score of 7.5 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 43 | 7.46 |
It may take a day or so for new Datapower Gateway 1060 vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent IBM Datapower Gateway 1060 Security Vulnerabilities
IBM DataPower Gateway 10.5-11.0 Heap Buffer Overflow (Unauth Remote Exec)
CVE-2026-14269
9.8 - Critical
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.
Heap-based Buffer Overflow
IBM DataPower Gateway 10.5-11.0 Authenticated Signature Forge via Improper Auth
CVE-2026-13257
6.5 - Medium
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity.
Insufficient Verification of Data Authenticity
IBM DataPower GW <10.5.0.22,<10.6.6,<11.0.2 XSS Authenticated WebUI
CVE-2026-13258
5.4 - Medium
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
XSS
IBM DataPower Gateway LB-Auth Bypass 10.5-11.0 (pre-11.0.3)
CVE-2026-14273
6.5 - Medium
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.
AuthZ
IBM DataPower GW 10.5-11.0 Heap Buffer Overflow DoS
CVE-2026-14496
8.2 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
Out-of-bounds Read
IBM DataPower GW 10.5-11.0 Auth Bypass via Improper Crypto Sig Verif
CVE-2026-14497
8.1 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.
Improper Verification of Cryptographic Signature
IBM DataPower Gateway LDAP Empty Password Auth Bypass 10.5-11.0
CVE-2026-14502
9.8 - Critical
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.
authentification
IBM DataPower Gateway <10.5.0.22,10.6.6,11.0.2> UAF DoS & Info Leak
CVE-2026-14508
6.5 - Medium
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.
Dangling pointer
IBM DataPower Gateway <10.5.0.22,10.6.6,11.0.2: DoS via Linked-List Traversal
CVE-2026-14509
5.9 - Medium
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to algorithmic complexity in linked-list traversal.
Resource Exhaustion
Heap Overflow RCE in IBM DataPower Gateway 11.0.0.2
CVE-2026-14888
8.1 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.
Heap-based Buffer Overflow
IBM DataPower Gateway XML Engine XXE before 11.0.0.3
CVE-2026-14905
8.2 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
XXE
IBM DataPower Gateway Buffer Overflow 10.5.0.0-11.0.0.2
CVE-2026-14988
6.5 - Medium
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.
Out-of-bounds Read
IBM DataPower GW Auth Bypass via Forged JWT 10.510.6.6, 11.0.0.02
CVE-2026-14999
7.4 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.
Improper Verification of Cryptographic Signature
IBM DataPower GW Buffer Overflow 10.5.0.0-22,10.6.0.0-10,10.6.1-6,11.0.0.0-2
CVE-2026-14992
9.8 - Critical
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.
Memory Corruption
IBM DataPower Gateway 10.6.0.x Unauth. XSS in Web UI
CVE-2026-14990
9.3 - Critical
- October 08, 2026
IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
XSS
IBM DataPower Gateway <11.0.0.2 Buffer Overflow (Local)
CVE-2026-14991
9.8 - Critical
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
Memory Corruption
IBM DataPower Gateway 10.5-11.0 Buffer Overflow Remote Auth Exec
CVE-2026-15781
8 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
Stack Overflow
Remote Code Exec in IBM DataPower Gateway 10.5.x-11.0.x via OOB Write
CVE-2026-15784
8.1 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
Memory Corruption
Remote Code Exec via OOB Write in IBM DataPower Gateway 10.5-11.0
CVE-2026-15762
9.8 - Critical
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
Memory Corruption
IBM DataPower Gateway 10.5-11.0 DoS via OOB Memory Access in Comparator
CVE-2026-15819
7.5 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to out-of-bounds memory access caused by a strict-weak-ordering violation in a sorting comparator.
Memory Corruption
IBM DataPower GW 10.5-11.0: Remote DoS via GraphQL Memoization
CVE-2026-15822
7.5 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads.
Amplification
IBM DataPower GW 10.x/11.x Remote DDoS via heap buffer overflow
CVE-2026-15824
8.2 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
Memory Corruption
IBM DataPower 10.511.0 DoS via Type Confusion
CVE-2026-16111
7.5 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.
Object Type Confusion
IBM DataPower Gateway 10.5-11.0 OOB Write Remote Info Disclosure & DoS
CVE-2026-16159
8.6 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.
Memory Corruption
Out-of-Bounds Read in IBM DataPower Gateway < 10.5.0.23, 10.6.0-6, 11.0.0-2 Causes DoS
CVE-2026-16161
7.5 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
Out-of-bounds Read
IBM DataPower Gateway 10.5-11.0 Buffer Overflow DoS
CVE-2026-16164
7.5 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a buffer overflow.
Memory Corruption
IBM DataPower GW 10.5-11.0.0.* NPE DoS
CVE-2026-16165
7.5 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.
NULL Pointer Dereference
IBM DataPower Gateway 10.5-11.0 OOB Write Memory Corruption
CVE-2026-16163
8.6 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption due to an out-of-bounds write.
Memory Corruption
IBM DataPower Gateway 10.5-11.0 DDoS via Improper Bounds Checking
CVE-2026-16167
7.5 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checking.
Memory Corruption
IBM DataPower GW Denial of Service via Heap Buffer Overflow (10.5.0.0-10.6.0.10)
CVE-2026-16170
7.5 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
Memory Corruption
IBM DataPower Gateway 10.6.6/10.5.0.22/10.6.0.10/11.0.0.2: DoS via Length Val
CVE-2026-16176
7.5 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation.
Allocation of Resources Without Limits or Throttling
IBM DataPower GW OOB Read (v10.5v11.0)
CVE-2026-16177
5.3 - Medium
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.
Out-of-bounds Read
IBM DataPower GW <=10.5.0.22/<=10.6.6/<=11.0.0.2: Remote DoS via Improper Validation
CVE-2026-16178
7.5 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validation.
Memory Corruption
IBM DataPower Gateway 10.5-11.0 OOB Write in RFC2047 Parser
CVE-2026-16340
9.8 - Critical
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser.
Memory Corruption
IBM DataPower Gateway 10.x-11.x auth bypass CVE-2026-16181
CVE-2026-16181
7.4 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass security restrictions due to improper authorization.
AuthZ
IBM DataPower GW 10.522/10.6.16/10.6.010/11.0.02 Heap BU Crash
CVE-2026-16179
7.5 - High
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.
buffer underrun
IBM DataPower Gwy 10.5.0.0-11.0.0.2 Null Ptr Deref in GraphQL Varn Process
CVE-2026-16182
5.9 - Medium
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable processing.
NULL Pointer Dereference
IBM DataPower Gateway SSRF (before 11.0.0.3)
CVE-2026-14521
4.9 - Medium
- October 08, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
SSRF
IBM DataPower GW 10.5-11.0: Race Condition on XClientIP Enables IP Spoofing
CVE-2026-7366
4.2 - Medium
- August 12, 2026
IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the builtin XClientIP header. Under concurrent request processing, XClientIP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients IP addresses.
Race Condition
IBM DataPower Gateway: Remote DoS via Resource Exhaustion
CVE-2026-12733
7.5 - High
- July 30, 2026
IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.
Allocation of Resources Without Limits or Throttling
IBM DataPower Gateway XXE Vulnerability Exposes Sensitive Data
CVE-2025-36374
5.5 - Medium
- July 30, 2026
IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.
XXE
IBM DataPower Gateway 10.x CSRF Vulnerability (10.5.0-10.6.5)
CVE-2025-36375
6.5 - Medium
- April 01, 2026
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Session Riding
IBM DataPower Gateway <=10.6.5.0 Admin Info Disclosure
CVE-2025-36373
4.1 - Medium
- April 01, 2026
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user.
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for IBM Datapower Gateway 1060 or by IBM? Click the Watch button to subscribe.
