CVE-2025-36373

Incorrect administrative access control in IBM DataPower Gateway

State: Published
Severity: 4.1 Medium
Published: Apr 1, 2026
Updated: Apr 2, 2026
Reserved: Apr 15, 2025

Description

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user.

Scores

CVSS	Score	Vector	Source
3.1	4.1 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N	ibm

Weaknesses

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affected Products

Product	Versions
DataPower Gateway 10.6CDIBM	10.6.1.0 through 10.6.5.0Affected
DataPower Gateway 10.5.0IBM	10.5.0.0 through 10.5.0.20Affected
DataPower Gateway 10.6.0IBM	10.6.0.0 through 10.6.0.8Affected

References

https://www.ibm.com/support/pages/node/7267833vendor-advisorypatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.