IBM DataPower Gateway gets massive patch bundle
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
NCSC-NL advisory for IBM DataPower Gateway 10.5-11.0 lists over 170 CVEs, several critical (CVSS 9.8) enabling remote code execution, DoS, or auth bypass.
NCSC-NL published an advisory covering IBM DataPower Gateway versions 10.5 through 11.0 and its numerous underlying subcomponents, consolidating patches for a very large set of vulnerabilities previously fixed individually in those components and now rolled into IBM's software stack. The flaw classes span memory-safety issues (use-after-free, buffer overflows, out-of-bounds read/write, double-free, NULL pointer dereference), race conditions (TOCTOU, signal handler races), input-validation failures (path traversal, XML/XPath injection, CRLF injection, argument injection, XXE), cryptographic weaknesses (improper certificate validation, signature verification failures, hard-coded passwords), and authorization/privilege issues.
According to IBM and NCSC-NL, successful exploitation of these flaws can lead to remote code execution, denial of service, cross-site scripting, or authorization bypass; some attack paths require authentication while others do not. No indication of active exploitation in the wild is given in the advisory — this is a vendor patch release, not an incident report. Given the breadth of the codebase affected (DataPower Gateway plus many underlying third-party/open-source subcomponents), organizations running DataPower as an API gateway or XML security gateway should treat this as a priority patching exercise.
Defenders should apply the IBM-supplied patches referenced in the advisory as soon as possible, prioritizing instances exposed to untrusted networks given several CVEs carry CVSS scores of 9.1-9.8 and do not require authentication. Review DataPower configuration for externally reachable management or XML processing interfaces, and monitor for anomalous crashes, unexpected process restarts, or malformed XML/HTTP traffic that could indicate exploitation attempts against the parsing and buffer-handling issues described.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0431.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs