CVE-2025-36374: IBM Datapower Gateway 10.5.0

Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days.

IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.

Affected products

• IBM Datapower Gateway 10.5.0: from 10.5.0.0, up to and including 10.5.0.21
• IBM Datapower Gateway 10.6.0: from 10.6.0.0, up to and including 10.6.0.9
• IBM Datapower Gateway 10.6cd: from 10.6.1, up to and including 10.6.6

Published 2026-07-30. Last modified 2026-09-29.