# IBM DataPower Gateway gets massive patch bundle

Published: 2026-10-16 · Severity: elevated
Canonical: https://vorant.io/reports/46bb9f69-a41c-5107-9fb1-67093fc6e861/ibm-datapower-gateway-gets-massive-patch-bundle

> NCSC-NL advisory for IBM DataPower Gateway 10.5-11.0 lists over 170 CVEs, several critical (CVSS 9.8) enabling remote code execution, DoS, or auth bypass.

NCSC-NL published an advisory covering IBM DataPower Gateway versions 10.5 through 11.0 and its numerous underlying subcomponents, consolidating patches for a very large set of vulnerabilities previously fixed individually in those components and now rolled into IBM's software stack. The flaw classes span memory-safety issues (use-after-free, buffer overflows, out-of-bounds read/write, double-free, NULL pointer dereference), race conditions (TOCTOU, signal handler races), input-validation failures (path traversal, XML/XPath injection, CRLF injection, argument injection, XXE), cryptographic weaknesses (improper certificate validation, signature verification failures, hard-coded passwords), and authorization/privilege issues.

According to IBM and NCSC-NL, successful exploitation of these flaws can lead to remote code execution, denial of service, cross-site scripting, or authorization bypass; some attack paths require authentication while others do not. No indication of active exploitation in the wild is given in the advisory — this is a vendor patch release, not an incident report. Given the breadth of the codebase affected (DataPower Gateway plus many underlying third-party/open-source subcomponents), organizations running DataPower as an API gateway or XML security gateway should treat this as a priority patching exercise.

Defenders should apply the IBM-supplied patches referenced in the advisory as soon as possible, prioritizing instances exposed to untrusted networks given several CVEs carry CVSS scores of 9.1-9.8 and do not require authentication. Review DataPower configuration for externally reachable management or XML processing interfaces, and monitor for anomalous crashes, unexpected process restarts, or malformed XML/HTTP traffic that could indicate exploitation attempts against the parsing and buffer-handling issues described.

## Mentioned in this report

- Vulnerabilities: CVE-2025-71066, CVE-2026-12143, CVE-2026-14269, CVE-2026-14502, CVE-2026-14990, CVE-2026-14991, CVE-2026-14992, CVE-2026-15762, CVE-2026-16340, CVE-2026-23216, CVE-2026-23455, CVE-2026-31607, CVE-2026-33845, CVE-2026-41607, CVE-2026-42010, CVE-2026-43037, CVE-2026-43038, CVE-2026-43125, CVE-2026-43284 (weaponized), CVE-2026-43501, CVE-2026-43870, CVE-2026-48144, CVE-2026-52991, CVE-2026-53009, CVE-2026-5450, CVE-2026-55968, CVE-2026-58016, CVE-2026-58662, CVE-2026-59879, CVE-2026-59880, CVE-2026-64017, CVE-2026-64530, CVE-2026-74581, CVE-2026-83605, CVE-2026-83607, CVE-2026-83608, CVE-2026-83613, CVE-2026-83614, CVE-2026-83615, CVE-2026-83616

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0431.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/46bb9f69-a41c-5107-9fb1-67093fc6e861/ibm-datapower-gateway-gets-massive-patch-bundle.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup