CVE-2026-13257: IBM DataPower Gateway Insufficient Verification of Data Authenticity
Published Sep 28, 2026
·Updated
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity.
Other sources
IBM DataPower Gateway could allow an authenticated user to forge signature requests due to improper verification of data authenticity.
— IBM
Affected Software
4 affected components
IBM DataPower Gateway 10.6CD<=10.6.1 - 10.6.6
IBM DataPower Gateway 10.6.0<=10.6.0.0 - 10.6.0.10
IBM DataPower Gateway 11.0.0<=11.0.0.0 - 11.0.0.2
IBM DataPower Gateway 10.5.0<=10.5.0.0 - 10.5.0.22
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM DataPower Gatewayto a version that resolves this vulnerability.Fixed in 11.0.0.3 - Upgrade
Upgrade
IBM DataPower Gatewayto a version that resolves this vulnerability.Fixed in 10.6.0.11 - Upgrade
Upgrade
IBM DataPower Gatewayto a version that resolves this vulnerability.Fixed in 10.5.0.23
Event History
Sep 28, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Oct 8, 2026
CVE Published
via MITRE·02:08 PM
Data Sourced
via MITRE·02:08 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness