CVE-2025-36375

IBM DataPower Gateway vulnerable to CSRF

State: Published
Severity: 6.5 Medium
Published: Apr 1, 2026
Updated: Apr 3, 2026
Reserved: Apr 15, 2025

Description

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	ibm

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
DataPower Gateway 10.6CDIBM	10.6.1.0 through 10.6.5.0Affected
DataPower Gateway 10.5.0IBM	10.5.0.0 through 10.5.0.20Affected
DataPower Gateway 10.6.0IBM	10.6.0.0 through 10.6.0.8Affected

References

https://www.ibm.com/support/pages/node/7268034vendor-advisorypatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.