Cyber Resilience

CVE-2025-36375

Medium

Published: 01 April 2026

Published
01 April 2026
Modified
06 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS Score 0.0017 6.2th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-36375 is a medium-severity CSRF (CWE-352) vulnerability in Ibm Datapower Gateway. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 6.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-36375, published on 2026-04-01, is a cross-site request forgery (CSRF) vulnerability (CWE-352) in IBM DataPower Gateway. It affects versions 10.6CD from 10.6.1.0 through 10.6.5.0, 10.5.0 from 10.5.0.0 through 10.5.0.20, and 10.6.0 from 10.6.0.0 through 10.6.0.8. The flaw allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts, with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).

An unauthenticated attacker (PR:N) can exploit this over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R), such as tricking a legitimate user into visiting a malicious site or clicking a forged link. Successful exploitation enables high-impact integrity violations (I:H) by performing unauthorized actions on behalf of the trusted user, without affecting confidentiality or availability.

IBM provides details on mitigation and patches in their security advisory at https://www.ibm.com/support/pages/node/7268034.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious…

more

and unauthorized actions transmitted from a user that the website trusts.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2023-38739Same vendor: Ibm
CVE-2025-36418Same vendor: Ibm
CVE-2023-38714Same vendor: Ibm
CVE-2024-25034Same vendor: Ibm
CVE-2023-38713Same vendor: Ibm
CVE-2024-22347Same vendor: Ibm
CVE-2025-64647Same vendor: Ibm
CVE-2026-9170Same vendor: Ibm
CVE-2023-49886Same vendor: Ibm
CVE-2026-8644Same vendor: Ibm

Affected Assets

ibm
datapower gateway
10.5.0.0 — 10.5.0.21 · 10.6.0.0 — 10.6.0.9 · 10.6.1.0 — 10.6.6.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

SC-23 mandates session authenticity mechanisms such as CSRF tokens or SameSite cookies, directly preventing attackers from forging requests on behalf of authenticated users in IBM DataPower Gateway.

SI-2 Flaw Remediation good match
prevent

SI-2 requires timely identification, reporting, and remediation of flaws like this CSRF vulnerability via IBM-provided patches, comprehensively eliminating the exploit path.

SI-10 Information Input Validation partial match
prevent

SI-10 enforces validation of information inputs including CSRF tokens or referer headers, blocking forged cross-site requests that lack valid tokens.

References