CVE-2026-7366
IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 thro
CVSS
4.2
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Aug 12, 2026 · Last modified: Aug 12, 2026 · CWE-362
Not enough EPSS history yet.
IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-181504.3 MED—
———IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition.5hCVE-2026-182506.3 MED—
———IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race condition.5hCVE-2026-668028.1 HIG—
——0Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code over a network.20hCVE-2026-629087.0 HIG—
——0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.1dCVE-2026-628208.1 HIG—
——0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to execute code over a network.20hCVE-2026-627807.0 HIG—
——0Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.20h