CVE-2025-36375
Published: 01 April 2026
Summary
CVE-2025-36375 is a medium-severity CSRF (CWE-352) vulnerability in Ibm Datapower Gateway. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-23 mandates session authenticity mechanisms such as CSRF tokens or SameSite cookies, directly preventing attackers from forging requests on behalf of authenticated users in IBM DataPower Gateway.
SI-2 requires timely identification, reporting, and remediation of flaws like this CSRF vulnerability via IBM-provided patches, comprehensively eliminating the exploit path.
SI-10 enforces validation of information inputs including CSRF tokens or referer headers, blocking forged cross-site requests that lack valid tokens.
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.NVD Description
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious…
more
and unauthorized actions transmitted from a user that the website trusts.
Deeper analysisAI
CVE-2025-36375, published on 2026-04-01, is a cross-site request forgery (CSRF) vulnerability (CWE-352) in IBM DataPower Gateway. It affects versions 10.6CD from 10.6.1.0 through 10.6.5.0, 10.5.0 from 10.5.0.0 through 10.5.0.20, and 10.6.0 from 10.6.0.0 through 10.6.0.8. The flaw allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts, with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).
An unauthenticated attacker (PR:N) can exploit this over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R), such as tricking a legitimate user into visiting a malicious site or clicking a forged link. Successful exploitation enables high-impact integrity violations (I:H) by performing unauthorized actions on behalf of the trusted user, without affecting confidentiality or availability.
IBM provides details on mitigation and patches in their security advisory at https://www.ibm.com/support/pages/node/7268034.
Details
- CWE(s)