CVE-2025-36373CWE-497

CVE-2025-36373

Medium · published April 2, 2026

CVSS v3.1
4.1
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.8th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2026-04-02T01:16Z
Affected products (3)
ProductVersionsFixed in
ibm/datapower_gateway≥ 10.5.0.0, < 10.5.0.2110.5.0.21
ibm/datapower_gateway≥ 10.6.0.0, < 10.6.0.910.6.0.9
ibm/datapower_gateway≥ 10.6.1.0, < 10.6.6.010.6.6.0
References (1)
https://www.ibm.com/support/pages/node/7267833 · [email protected]
EPSS history
Timeline
  • 01 APR 20:47Z
    Incorrect administrative access control in IBM DataPower Gateway
    cvelistv5