---
id: CVE-2025-36375
title: >-
  IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower
  Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0
  10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site
  request forge…
summary: >-
  IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower
  Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0
  10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site
  request forge…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'
cwe:
  - CWE-352
vendor: ibm
product: datapower_gateway
affected:
  - 'datapower_gateway >= 10.5.0.0, < 10.5.0.21'
  - 'datapower_gateway >= 10.6.0.0, < 10.6.0.9'
  - 'datapower_gateway >= 10.6.1.0, < 10.6.6.0'
patched:
  - datapower_gateway 10.6.6.0
published: '2026-04-01'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:10:00.210'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-36375'
references:
  - url: 'https://www.ibm.com/support/pages/node/7268034'
    label: psirt@us.ibm.com
tags:
  - nvd
epss: 0.00167
epssPercentile: 0.05539
ingestedAt: '2026-10-14T17:44:53.610Z'
---

## Overview

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

## Affected

- `datapower_gateway >= 10.5.0.0, < 10.5.0.21`
- `datapower_gateway >= 10.6.0.0, < 10.6.0.9`
- `datapower_gateway >= 10.6.1.0, < 10.6.6.0`

## Remediation

Upgrade past the affected range:

- `datapower_gateway 10.6.6.0`