Quick answers
- Is CVE-2026-12733 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12733 being exploited in the wild.
- How severe is CVE-2026-12733?
- High severity, with a CVSS score of 7.5, published 30 July 2026.
- Which products and versions are affected?
- IBM DataPower Gateway 10.5.0.0 - 10.5.0.21.
- Is there a fix for CVE-2026-12733?
- A patch was published on 2026-07-01: Fixes released in versions 10.5.0.22, 10.6.0.10, and 11.0.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-12733 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-12733?
- Check whether you run IBM DataPower Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
IBM DataPower Gateway is vulnerable to a denial of service (DoS) attack due to improper resource limitations (CWE-770). The vulnerability is specifically related to the handling of HTTP/2 traffic, where the system fails to properly throttle or limit resource allocation. A remote, unauthenticated attacker can exploit this by sending specially crafted requests over the network, leading to resource exhaustion and a complete loss of availability. IBM has released firmware updates to address this issue. As a temporary mitigation, administrators can disable HTTP/2 support if immediate patching is not possible.
Affected products
- IBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.21
- IBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.9
- IBM DataPower Gateway 10.6CD 10.6.1 - 10.6.6
- IBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.1
Timeline
- 2026-07-01: disclosed: Initial publication by IBM
- 2026-07-01: patched: Fixes released in versions 10.5.0.22, 10.6.0.10, and 11.0.0.2
- 2026-07-30: advisory: NVD publication date