CVE-2026-16340 (CRITICAL, CVSS 9.8): IBM DataPower Gateway 10.5.0.0 – 10.5.0.22, 10.6.0.0 – 10.6.0.10, 10.6.1 – 10.6.6, 11.0.0.0 – 11.0.0.2

IBM's October 8, 2026 mass disclosure for DataPower Gateway covers 11 CVEs across four version lines: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6CD 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. The headline bug is CVE-2026-16340, an out-of-bounds write (CWE-787) scored 9.8, and per threataft's summary of the disclosure the batch holds two unauthenticated RCEs at that score plus CVE-2026-14990, a credential-stealing XSS rated 9.3. Canada's Cyber Centre relayed the same set the same day in advisory AV26-1022, alongside an unrelated Langflow OSS batch covering versions 1.0.0 to 1.12.2. As of October 8 the reporting is advisory aggregators and national CERT relay only: no in-the-wild exploitation, no public PoC.

The severity here is positional, not just numeric. DataPower terminates, transforms and authenticates API traffic inside banks, insurers and other large enterprises, so an unauthenticated memory-corruption bug on that tier is pre-auth code execution on the front door itself, and one unpatched instance exposes every backend API routed through it. The batch structure is also the argument: eleven bugs patched in one pass means exposure is binary, any instance on an affected line needs the fix regardless of which CVE a scanner flags first. And the pairing matters operationally, a 9.3 XSS built to steal operator credentials alongside a 9.8 RCE means defenders cannot fence off the memory-corruption path alone, because the disclosure explicitly arms attackers against the administrative plane where trusted sessions originate.

Defender actions, in order: inventory against the four affected lines and treat internet-exposed DataPower instances as the first patch cohort; apply the fixes from the IBM security bulletins referenced in AV26-1022, which includes separate bulletins for the multi-CVE set and for the XSS; restrict management and operator interfaces to admin networks or VPN so the XSS cannot reach a browsing operator from the public internet. For hunting, work from what the disclosure implies: unexpected crashes or restarts of gateway services consistent with memory corruption, anomalous request patterns against processing rules and web service proxies, and new operator or admin sessions from unfamiliar sources, since harvested credentials are the stated goal of CVE-2026-14990.

Two developments would change this assessment. Public PoC code or scan telemetry against DataPower endpoints would collapse the quiet window and justify emergency patching. An addition of any CVE in the batch to CISA's KEV catalog, or an IBM update marking the bugs as exploited or superseding the original bulletins, would confirm the batch has moved from disclosed to targeted.