IBM says it fixed multiple vulnerabilities in DataPower Gateway versions 10.5 through 11.0, along with issues in bundled subcomponents. NCSC-NL published the advisory on October 16 and describes a broad mix of bug classes, from memory-safety flaws to injection and validation problems.
The point is breadth, not a single attack path: the fixes cover the appliance and the code it ships with, so operators may need to line up version status across both layers. Nothing in the advisory indicates active exploitation or a shift in threat activity.
For environments that use DataPower as a front door or integration tier, the exposure stays wherever those versions remain in service until the patched release is in place. This is a normal patch-cycle story, but the number of CVEs means the maintenance footprint can be wider than a single-product update.
1 source · 1 day ago
CVEs in this update
202 CVEs
Across Enterprise Linux, F5OS, Linux, and related packages.