IBM DataPower Gateway Patches 11 Flaws, Including Critical Unauthenticated RCE
Vulnerability Disclosure · 6 sources · Updated 14d ago · First seen Oct 8, 2026
IBM published security bulletins addressing 11 vulnerabilities in DataPower Gateway, including two unauthenticated remote code execution flaws, CVE-2026-14991 and CVE-2026-15762, each rated CVSS 9.8. Affected releases across the disclosures span the 10.5.0, 10.6.0, 10.6CD, and 11.0.0 branches. ThreatAft reported that it had identified no public exploits or known active exploitation and that the vulnerabilities were not listed in CISA’s Known Exploited Vulnerabilities catalog.
IBM’s bulletin confirms that CVE-2026-14990, a CVSS 9.3 cross-site scripting flaw, affects versions 10.6.0.0 through 10.6.0.10. An unauthenticated attacker could inject arbitrary JavaScript into the Web UI, potentially altering functionality and exposing credentials within a trusted session; exploitation requires user interaction. IBM fixed this flaw in 10.6.0.11 and strongly recommends prompt upgrades. Administrators should inventory affected gateways and install the applicable fixed release for each branch, as no official workarounds are documented.
