PatchSiren cyber security CVE debrief

CVE-2026-15822 IBM CVE debrief

IBM DataPower Gateway is vulnerable to a denial of service due to improper memoization of GraphQL fragment spreads. This issue affects various versions of IBM DataPower Gateway, including 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. The vulnerability could allow a remote attacker to cause a denial of service. Defenders should prioritize verifying exposure in their inventory and assessing the potential impact on their systems. The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploitation or impact.

Vendor: IBM
Product: DataPower Gateway 10.6CD
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-08
Original CVE updated: 2026-10-08
Advisory published: 2026-10-08
Advisory updated: 2026-10-08

Who should care

Defenders responsible for IBM DataPower Gateway systems, particularly those using affected versions, should assess potential exposure and prioritize verification and remediation efforts.

Why it matters

IBM DataPower Gateway is vulnerable to a denial of service due to improper memoization of GraphQL fragment spreads. Defenders should prioritize verifying exposure in their inventory and assessing the potential impact on their systems.

Potential denial of service attacks against IBM DataPower Gateway systems
Need to verify exposure in inventory and assess potential impact
Priority on applying vendor-provided patches or updates
Monitoring systems for potential attacks

Technical summary

Defensive priority

Defenders should prioritize verifying exposure in their inventory and assessing the potential impact on their systems.

Recommended defensive actions

Verify inventory for affected IBM DataPower Gateway versions and assess potential exposure
Review and apply vendor-provided patches or updates
Monitor systems for potential denial of service attacks

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploitation or impact. Defenders should verify affected product deployments in managed environments and review official advisories or CVE records to validate affected scope, severity, and vendor guidance. Limited source information is available on potential exploitation or impact, and defenders should plan vendor-supported updates or mitigations through normal change

Sources and references

Verified primary and authoritative sources

CVE-2026-15822 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-15822

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-15822 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-15822

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

IBM DataPower Gateway Denial of Service
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15822.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://www.ibm.com/support/pages/node/7289775

Supplemental source - vendor-advisory, patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.