---
id: CVE-2025-36373
title: >-
  IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower
  Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0
  10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive
  system informati…
summary: >-
  IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower
  Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0
  10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive
  system informati…
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N'
cwe:
  - CWE-497
vendor: ibm
product: datapower_gateway
affected:
  - 'datapower_gateway >= 10.5.0.0, < 10.5.0.21'
  - 'datapower_gateway >= 10.6.0.0, < 10.6.0.9'
  - 'datapower_gateway >= 10.6.1.0, < 10.6.6.0'
patched:
  - datapower_gateway 10.6.6.0
published: '2026-04-01'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:10:00.210'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-36373'
references:
  - url: 'https://www.ibm.com/support/pages/node/7267833'
    label: psirt@us.ibm.com
tags:
  - nvd
epss: 0.00252
epssPercentile: 0.15533
ingestedAt: '2026-10-14T17:44:53.609Z'
---

## Overview

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user.

## Affected

- `datapower_gateway >= 10.5.0.0, < 10.5.0.21`
- `datapower_gateway >= 10.6.0.0, < 10.6.0.9`
- `datapower_gateway >= 10.6.1.0, < 10.6.6.0`

## Remediation

Upgrade past the affected range:

- `datapower_gateway 10.6.6.0`