# CVE-2025-36375: IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and…

Source: https://junglewise.ai/threats/cve-2025-36375-ibm-datapower-gateway-10-6cd-10-6-1-0-through-10-6-5-0-and-ibm  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-01  
License: CC BY 4.0 with a link back

CVE-2025-36375 · Severity: medium · CVSS 6.5 · Published 2026-04-01

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Technologies: [IBM DataPower Gateway](https://junglewise.ai/threats/technologies/datapower-gateway). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2025-36375 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-36375 being exploited in the wild.

**How severe is CVE-2025-36375?** Medium severity, with a CVSS score of 6.5, published 1 April 2026.

**Which products and versions are affected?** IBM DataPower Gateway. The advisory does not name versions.

**Is there a fix for CVE-2025-36375?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-36375?** Check whether you run IBM DataPower Gateway. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- IBM DataPower Gateway

## Related threats

- [IBM DataPower Gateway race condition in X-Client-IP header handling](https://junglewise.ai/threats/cve-2026-7366-ibm-datapower-gateway-race-condition-in-x-client-ip-header)
- [IBM DataPower Gateway denial of service via improper resource limits](https://junglewise.ai/threats/cve-2026-12733-ibm-datapower-gateway-denial-of-service-via-improper-resource)
- [IBM DataPower Gateway XML external entity injection](https://junglewise.ai/threats/cve-2025-36374-ibm-datapower-gateway-xml-external-entity-injection)
- [IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and…](https://junglewise.ai/threats/cve-2025-36373-ibm-datapower-gateway-10-6cd-10-6-1-0-through-10-6-5-0-and-ibm)