CVE-2026-16169: IBM DataPower Gateway Denial of Service

Q: What access does an attacker need to exploit this issue?

The issue is remotely exploitable and requires no privileges or user interaction, as indicated by the AV:N/AC:L/PR:N/UI:N vector.

Q: What is the expected impact?

Successful exploitation can cause a denial of service through uncontrolled resource consumption. The supplied impact vector indicates availability impact only, with no stated confidentiality or integrity impact.

Q: Which versions are known to be affected?

IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 are identified as affected.

Published Sep 28, 2026

Updated

IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

Other sources

IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

— IBM

Affected Software

2 affected components

IBM DataPower Gateway 11.0.0<=11.0.0.0 - 11.0.0.2

IBM DataPower Gateway>=11.0.0.0<=11.0.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM DataPower Gateway to a version that resolves this vulnerability.
Fixed in 11.0.0.3

Event History

Sep 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 8, 2026

CVE Published

via MITRE·01:13 PM

Data Sourced

via MITRE·01:13 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7289798

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue is remotely exploitable and requires no privileges or user interaction, as indicated by the AV:N/AC:L/PR:N/UI:N vector.

What is the expected impact?

Successful exploitation can cause a denial of service through uncontrolled resource consumption. The supplied impact vector indicates availability impact only, with no stated confidentiality or integrity impact.

Which versions are known to be affected?

IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 are identified as affected.

CVE-2026-16169: IBM DataPower Gateway Denial of Service

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected impact?

Which versions are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected impact?

Which versions are known to be affected?