# CVE-2025-36374: IBM DataPower Gateway XML external entity injection

Source: https://junglewise.ai/threats/cve-2025-36374-ibm-datapower-gateway-xml-external-entity-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2025-36374 · Severity: medium · CVSS 5.5 · Published 2026-07-30

IBM DataPower Gateway, a security and integration platform for mobile, web, and API workloads, is vulnerable to an XML processing flaw. A user with high-level administrative privileges could exploit this to access sensitive internal information or cause a denial-of-service by exhausting system memory. While the risk is mitigated by the requirement for administrative access, an exploit could still impact the availability of critical business services and expose internal data.

Technologies: [IBM DataPower Gateway](https://junglewise.ai/threats/technologies/datapower-gateway). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2025-36374 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-36374 being exploited in the wild.

**How severe is CVE-2025-36374?** Medium severity, with a CVSS score of 5.5, published 30 July 2026.

**Which products and versions are affected?** IBM DataPower Gateway 10.6.1 - 10.6.6.

**Is there a fix for CVE-2025-36374?** A patch was published on 2026-07-01: Fixes released in versions 11.0.0.2, 10.5.0.22, and 10.6.0.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-36374 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-36374?** Check whether you run IBM DataPower Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

IBM DataPower Gateway is vulnerable to an XML External Entity (XXE) injection (CWE-611) due to improper restriction of XML external entity references during XML data processing. The vulnerability is reachable over the network but requires high privileges (PR:H) to exploit. An attacker with these credentials can submit a specially crafted XML document containing malicious external entity references. Successful exploitation allows the attacker to read local files (information disclosure) or trigger excessive memory consumption, leading to a denial-of-service (DoS) condition. IBM has released patches for affected versions 10.5.0, 10.6.0, and 10.6CD.

## Affected products

- IBM DataPower Gateway 10.6CD 10.6.1 - 10.6.6
- IBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.21
- IBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.9

## Timeline

- 2026-07-01: disclosed: Initial publication by IBM
- 2026-07-01: patched: Fixes released in versions 11.0.0.2, 10.5.0.22, and 10.6.0.10
- 2026-07-30: advisory: NVD publication date

## References

- [https://www.ibm.com/support/pages/node/7278748](https://www.ibm.com/support/pages/node/7278748)

## Related threats

- [IBM DataPower Gateway race condition in X-Client-IP header handling](https://junglewise.ai/threats/cve-2026-7366-ibm-datapower-gateway-race-condition-in-x-client-ip-header)
- [IBM DataPower Gateway denial of service via improper resource limits](https://junglewise.ai/threats/cve-2026-12733-ibm-datapower-gateway-denial-of-service-via-improper-resource)
- [IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and…](https://junglewise.ai/threats/cve-2025-36375-ibm-datapower-gateway-10-6cd-10-6-1-0-through-10-6-5-0-and-ibm)
- [IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and…](https://junglewise.ai/threats/cve-2025-36373-ibm-datapower-gateway-10-6cd-10-6-1-0-through-10-6-5-0-and-ibm)