{"id":"CVE-2025-36375","title":"IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forge…","summary":"IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forge…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cwe":["CWE-352"],"vendor":"ibm","product":"datapower_gateway","affected":["datapower_gateway >= 10.5.0.0, < 10.5.0.21","datapower_gateway >= 10.6.0.0, < 10.6.0.9","datapower_gateway >= 10.6.1.0, < 10.6.6.0"],"patched":["datapower_gateway 10.6.6.0"],"published":"2026-04-01","updated":"2026-10-14","sourceUpdated":"2026-10-14T17:10:00.210","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-36375","references":[{"url":"https://www.ibm.com/support/pages/node/7268034","label":"psirt@us.ibm.com"}],"tags":["nvd"],"epss":0.00167,"epssPercentile":0.05539,"ingestedAt":"2026-10-14T17:44:53.610Z","slug":"CVE-2025-36375","body":"## Overview\n\nIBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.\n\n## Affected\n\n- `datapower_gateway >= 10.5.0.0, < 10.5.0.21`\n- `datapower_gateway >= 10.6.0.0, < 10.6.0.9`\n- `datapower_gateway >= 10.6.1.0, < 10.6.6.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `datapower_gateway 10.6.6.0`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}