PT-2026-29640 · Ibm · Ibm Datapower Gateway

Published 2026-04-01 · Updated 2026-04-02 · CVE-2025-36375

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.20 and versions 10.6.0.0 through 10.6.0.8 and versions 10.6CD 10.6.1.0 through 10.6.5.0

Description IBM DataPower Gateway is susceptible to cross-site request forgery, potentially enabling an attacker to perform unauthorized actions on behalf of a trusted user. This could allow an attacker to execute malicious actions.

Recommendations Update IBM DataPower Gateway to a version later than 10.6.5.0 Update IBM DataPower Gateway to a version later than 10.6.0.8 Update IBM DataPower Gateway to a version later than 10.5.0.20

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-36375

Affected Products

Ibm Datapower Gateway

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-36375 · Security Note
• https://twitter.com/CVEnew/status/2039647737185275963 · Twitter Post
• https://ibm.com/support/pages/node/7268034 · Vendor Advisory, Patch