IBM DataPower GW 10.5-11.0.0.* NPE DoS
CVE-2026-16165 Published on October 8, 2026
IBM DataPower Gateway NULL Pointer Dereference
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.
Vulnerability Analysis
CVE-2026-16165 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.
Products Associated with CVE-2026-16165
Want to know whenever a new CVE is published for IBM products? stack.watch will email you.
Affected Versions
IBM DataPower Gateway 10.6CD:- Version 10.6.1, <= 10.6.6 is affected.
- Version 10.6.0.0, <= 10.6.0.10 is affected.
- Version 11.0.0.0, <= 11.0.0.2 is affected.
- Version 10.5.0.0, <= 10.5.0.22 is affected.