IBM Application Gateway vulnerabilities

7 CVEs affecting IBM Application Gateway, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36397, published 2026-01-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-20576, published 2021-06-01. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. IBM Security Verify Access 20.07 could allow a remote attacker to send a specially crafted HTTP GET request that could cause the application to crash.
CVE-2024-28787, published 2024-04-04. Critical severity, CVSS 10.0. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote attacker to obtain highly sensitive private information or cause a denial of…
CVE-2022-22387, published 2022-09-28. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Application Gateway is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2021-20575, published 2021-06-01. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278.
CVE-2025-36397, published 2026-01-20. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser…
CVE-2025-36396, published 2026-01-20. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the…
CVE-2024-45655, published 2025-06-03. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment.