CVE-2026-12733

HighCVSS 7.5/10Last modified Aug 10, 2026

Description

IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
IBMDataPower Gateway 10.6CD>= 10.6.1, <= 10.6.6
IBMDataPower Gateway 10.6.0>= 10.6.0.0, <= 10.6.0.9
IBMDataPower Gateway 11.0.0>= 11.0.0.0, <= 11.0.0.1
IBMDataPower Gateway 10.5.0>= 10.5.0.0, <= 10.5.0.21

References

Timeline

Published
Jul 30, 2026
Last modified
Aug 10, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-127346.4The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site ScriptCVE-2026-127354.3IBM Controller Disclosure Management 1.0.0.0 could allow an attacker to obtain sensitive EXIF metadata from uploaded images due to improper CVE-2026-127368.0The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettinCVE-2026-127374.4IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.1_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.1_1 stores potentially sensitive iCVE-2026-127384.3The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions upCVE-2026-127394.3The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions upCVE-2026-12744.9IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access management control paCVE-2026-127408.1Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider auCVE-2026-127417.5The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' paCVE-2026-127425.4IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due tCVE-2026-127434.9The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via CVE-2026-127449.8A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execu
CVE-2026-12733: High severity, CVSS 7.5 | Vulnix