CVE-2025-36374
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could expose sensitive information or consume memory resources.
Risk Assessment
An attacker could access confidential data or cause memory exhaustion, leading to service disruption.
Recommendation
Update DataPower Gateway to a fixed version and disable processing of external XML entities.
Other vulnerabilities in IBM DataPower Gateway
See all- CVE-2026-7366Medium
IBM DataPower Gateway versions 11.0.0.0-11.0.0.1, 10.5.0.0-10.5.0.21, and 10.6.0.0-10.6.0.9 have a race condition that results in improper isolation of request state when handling the built-in X-Client-IP header. Under concurrent request processing, X-Client-IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients' IP addresses.
- CVE-2026-12733High
IBM DataPower Gateway is vulnerable to a denial of service (DoS) due to improper resource limitations. A remote attacker can exploit this to overload the system and disrupt normal operations.
Original NVD description (English source)
IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.