{"id":"CVE-2026-15784","published":"2026-10-08T14:16:52.220","lastModified":"2026-10-15T00:02:03.650","description":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-787"],"vendors":["ibm"],"products":["datapower gateway"],"references":[{"url":"https://www.ibm.com/support/pages/node/7289775","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A remote attacker can execute arbitrary code on IBM DataPower Gateway devices through an out-of-bounds write vulnerability in versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. This allows for complete system compromise with high impact.","exploitability":"Exploitation requires a remote network connection to the DataPower Gateway service with no authentication required, making it relatively easy to exploit with minimal preconditions.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full control over affected DataPower Gateway devices, potentially enabling them to intercept, modify, or redirect traffic through these critical network security appliances.","remediation":"Upgrade to IBM DataPower Gateway 10.5.0.23, 10.6.7, 10.6.0.11, or 11.0.0.3 to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","network","gateway","datacenter"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:20:34.130Z"}}