CTI · reviewed · 2026-10-09

CVE-2026-16340 (CRITICAL, CVSS 9.8): IBM DataPower Gateway 10.5.0.0 – 10.5.0.22, 10.6.0.0 – 10.6.0.10, 10.6.1 – 10.6.6, 11.0.0.0 – 11.0.0.2

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1539 Steal Web Session Cookie Credential Access

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://radar.offseq.com/threat/cve-2026-16340-cwe-787-out-of-bounds-write-in-ibm-datapower-gateway-106cd-0c7cd2fb359c85f5
• https://threataft.com/articles/ibm-datapower-mass-disclosure-2026
• https://malware.news/t/ibm-security-advisory-av26-1022/126272#post_1