[NEW] [low] IBM DataPower Gateway: Vulnerability enables manipulation of data and disclosure of information

CSIRTS triage

What

An authenticated attacker can manipulate data and disclose confidential information.

Who is affected

Systems with authenticated access to vulnerable IBM DataPower Gateway versions are affected.

Urgency

Low severity as exploitation requires prior authentication; address in routine patching.

Action

Apply available patches to IBM DataPower Gateway.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

low

Published

2026-08-07

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2696

Referenced CVEs

Recent advisories for IBM DataPower Gateway

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• high[NEW] [high] IBM DataPower Gateway: Multiple vulnerabilitiescert-bund · 2026-07-31
• highCVE-2026-12733: IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improp…nvd · 2026-07-30
• mediumCVE-2025-36374: IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when proc…nvd · 2026-07-30

More from CERT-Bund (BSI) Security Advisories

• medium[NEW] [medium] jsoup: Vulnerability enables Cross-Site Scripting2026-08-07
• high[NEW] [high] Apache Portable Runtime (APR): Multiple vulnerabilities2026-08-07
• high[UPDATE] [high] Linux Kernel: Multiple Vulnerabilities2026-08-07
• medium[UPDATE] [medium] Golang Go: Multiple vulnerabilities2026-08-07
• high[UPDATE] [high] Linux Kernel: Multiple vulnerabilities2026-08-07