CVE-2026-16111 (GCVE-0-2026-16111)
Vulnerability from cvelistv5
Published
2026-10-08 13:28
Modified
2026-10-08 15:51
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-843 - Access of resource using incompatible type ('type confusion')
Summary
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| IBM | DataPower Gateway 10.6CD |
Version: 10.6.1 ≤ 10.6.6 cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.6:*:*:*:*:*:*:* |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T15:50:12.760558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T15:51:27.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.6:*:*:*:*:*:*:*"
],
"product": "DataPower Gateway 10.6CD",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "10.6.6",
"status": "affected",
"version": "10.6.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.10:*:*:*:*:*:*:*"
],
"product": "DataPower Gateway 10.6.0",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "10.6.0.10",
"status": "affected",
"version": "10.6.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.2:*:*:*:*:*:*:*"
],
"product": "DataPower Gateway 11.0.0",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "11.0.0.2",
"status": "affected",
"version": "11.0.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.22:*:*:*:*:*:*:*"
],
"product": "DataPower Gateway 10.5.0",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "10.5.0.22",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.\u003c/p\u003e"
}
],
"value": "IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843 Access of resource using incompatible type (\u0027type confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:28:43.112Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7289775"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly advises upgrading as soon as possible.\u003c/p\u003e\u003cp\u003eKnown Issue: \u003ca href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000IiH7/dt499224\" rel=\"nofollow\"\u003eDT499224\u003c/a\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eAffected Versions\u003c/td\u003e\u003ctd\u003eFixed in Release\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM DataPower Gateway 10.6CD 10.6.1 - 10.6.6\u003c/td\u003e\u003ctd\u003e11.0.0.3\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.10\u003c/td\u003e\u003ctd\u003e10.6.0.11\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.2\u003c/td\u003e\u003ctd\u003e11.0.0.3\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.22\u003c/td\u003e\u003ctd\u003e10.5.0.23\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
}
],
"value": "IBM strongly advises upgrading as soon as possible.\nKnown Issue: DT499224\nAffected VersionsFixed in ReleaseIBM DataPower Gateway 10.6CD 10.6.1 - 10.6.611.0.0.3IBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.1010.6.0.11IBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.211.0.0.3IBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.2210.5.0.23"
}
],
"title": "IBM DataPower Gateway Type Confusion"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-16111",
"datePublished": "2026-10-08T13:28:43.112Z",
"dateReserved": "2026-07-17T15:22:42.475Z",
"dateUpdated": "2026-10-08T15:51:27.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-16111\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-08T15:50:12.760558Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-08T15:50:54.754Z\"}}], \"cna\": {\"title\": \"IBM DataPower Gateway Type Confusion\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.6:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"DataPower Gateway 10.6CD\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.6.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"10.6.6\"}]}, {\"cpes\": [\"cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.10:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"DataPower Gateway 10.6.0\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.6.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"10.6.0.10\"}]}, {\"cpes\": [\"cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.2:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"DataPower Gateway 11.0.0\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.0.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"11.0.0.2\"}]}, {\"cpes\": [\"cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.22:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"DataPower Gateway 10.5.0\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.5.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"10.5.0.22\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"IBM strongly advises upgrading as soon as possible.\\nKnown Issue: DT499224\\nAffected VersionsFixed in ReleaseIBM DataPower Gateway 10.6CD 10.6.1 - 10.6.611.0.0.3IBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.1010.6.0.11IBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.211.0.0.3IBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.2210.5.0.23\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM strongly advises upgrading as soon as possible.\u003c/p\u003e\u003cp\u003eKnown Issue: \u003ca href=\\\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000IiH7/dt499224\\\" rel=\\\"nofollow\\\"\u003eDT499224\u003c/a\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eAffected Versions\u003c/td\u003e\u003ctd\u003eFixed in Release\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM DataPower Gateway 10.6CD 10.6.1 - 10.6.6\u003c/td\u003e\u003ctd\u003e11.0.0.3\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.10\u003c/td\u003e\u003ctd\u003e10.6.0.11\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.2\u003c/td\u003e\u003ctd\u003e11.0.0.3\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.22\u003c/td\u003e\u003ctd\u003e10.5.0.23\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7289775\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-843\", \"description\": \"CWE-843 Access of resource using incompatible type (\u0027type confusion\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-10-08T13:28:43.112Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-16111\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-08T15:51:27.735Z\", \"dateReserved\": \"2026-07-17T15:22:42.475Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-10-08T13:28:43.112Z\", \"assignerShortName\": \"ibm\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…