Loading vulnerability…
Cross-site scripting in IBM DataPower Gateway Web UI
CVE-2026-14990 is a cross-site scripting vulnerability in the Web UI of IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10, inclusive. An unauthenticated remote attacker can embed arbitrary JavaScript in the interface, allowing script execution within a trusted browser session when a user interacts with the malicious content. Successful exploitation can alter the interface's intended functionality and potentially disclose credentials. The vulnerability has a CVSS v3.1 base score of 9.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality and integrity of a user's trusted Web UI session by executing attacker-controlled JavaScript, modifying interface behavior, and potentially exposing credentials. The CVSS assessment assigns high confidentiality and integrity impacts, changed scope, and no availability impact. This vulnerability does not establish server-side code execution.
If you can’t patch tonight, do this now.
IBM lists no official workarounds or mitigations. Restricting Web UI access to trusted management networks and using network segmentation can reduce exposure, but these compensating controls do not eliminate the vulnerability or replace the upgrade.
Patch, then assume compromise.
Upgrade affected IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 installations to version 10.6.0.11, which contains the fix. IBM strongly recommends upgrading as soon as possible.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.