CVE-2025-36375

HighCVSS 8.8/10Last modified Oct 14, 2026

Description

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
IBMDataPower Gateway 10.6CD>= 10.6.1.0, <= 10.6.5.0
IBMDataPower Gateway 10.5.0>= 10.5.0.0, <= 10.5.0.20
IBMDataPower Gateway 10.6.0>= 10.6.0.0, <= 10.6.0.8

References

Timeline

Published
Apr 1, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-363768.8IBM Security QRadar EDR 3.12 through 3.12.23 does not invalidate session after a session expiration which could allow an authenticated user CVE-2025-363778.8IBM Security QRadar EDR 3.12 through 3.12.23 does not invalidate session after a session expiration which could allow an authenticated user CVE-2025-363797.5IBM Security QRadar EDR 3.12 through 3.12.23 IBM Security ReaQta uses weaker than expected cryptographic algorithms that could allow an attaCVE-2025-36388.8A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site rCVE-2025-363847.8IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoCVE-2025-363869.8IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms CVE-2025-363876.5IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of serCVE-2025-36392.0Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13CVE-2025-363965.4IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed CVE-2025-363975.4IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when CVE-2025-363985.4IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to reaCVE-2025-36404.3A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as
CVE-2025-36375: High severity, CVSS 8.8 | Vulnix