CVE-2026-12733
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
IBM DataPower Gateway is vulnerable to a denial of service (DoS) due to improper resource limitations. A remote attacker can exploit this to overload the system and disrupt normal operations.
Risk Assessment
A DoS attack can render critical network services unavailable, leading to business disruption and loss of customer trust.
Recommendation
Apply the security patch from IBM for IBM DataPower Gateway or upgrade to a version that addresses the resource limitation issue.
Other vulnerabilities in IBM DataPower Gateway
See all- CVE-2026-7366Medium
IBM DataPower Gateway versions 11.0.0.0-11.0.0.1, 10.5.0.0-10.5.0.21, and 10.6.0.0-10.6.0.9 have a race condition that results in improper isolation of request state when handling the built-in X-Client-IP header. Under concurrent request processing, X-Client-IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients' IP addresses.
- CVE-2025-36374Medium
IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could expose sensitive information or consume memory resources.
Original NVD description (English source)
IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.