CVE-2026-13258: IBM DataPower Gateway Cross-Site Scripting

Q: What must an attacker have to exploit this issue?

The attacker must be authenticated and must be able to induce interaction with the crafted content in the Web UI. Successful exploitation allows arbitrary JavaScript to run in a trusted user session.

Q: What is the practical impact of a successful exploit?

Injected JavaScript can alter intended Web UI functionality and may disclose credentials available within the trusted session. The provided severity vector indicates low confidentiality and integrity impact, with no availability impact.

Q: Which deployed versions are affected?

Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2.

Published Sep 28, 2026

Updated

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Other sources

IBM DataPower Gateway is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

— IBM

Affected Software

4 affected components

IBM DataPower Gateway 10.6CD<=10.6.1 - 10.6.6

IBM DataPower Gateway 10.6.0<=10.6.0.0 - 10.6.0.10

IBM DataPower Gateway 11.0.0<=11.0.0.0 - 11.0.0.2

IBM DataPower Gateway 10.5.0<=10.5.0.0 - 10.5.0.22

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM DataPower Gateway 10.6CD to a version that resolves this vulnerability.
Fixed in 11.0.0.3
Upgrade
Upgrade IBM DataPower Gateway 10.6.0 to a version that resolves this vulnerability.
Fixed in 10.6.0.11
Upgrade
Upgrade IBM DataPower Gateway 11.0.0 to a version that resolves this vulnerability.
Fixed in 11.0.0.3
Upgrade
Upgrade IBM DataPower Gateway 10.5.0 to a version that resolves this vulnerability.
Fixed in 10.5.0.23

Event History

Sep 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 8, 2026

CVE Published

via MITRE·02:08 PM

Data Sourced

via MITRE·02:08 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7289775

Frequently Asked Questions

What must an attacker have to exploit this issue?

The attacker must be authenticated and must be able to induce interaction with the crafted content in the Web UI. Successful exploitation allows arbitrary JavaScript to run in a trusted user session.

What is the practical impact of a successful exploit?

Injected JavaScript can alter intended Web UI functionality and may disclose credentials available within the trusted session. The provided severity vector indicates low confidentiality and integrity impact, with no availability impact.

Which deployed versions are affected?

Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2.

CVE-2026-13258: IBM DataPower Gateway Cross-Site Scripting

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What must an attacker have to exploit this issue?

What is the practical impact of a successful exploit?

Which deployed versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker have to exploit this issue?

What is the practical impact of a successful exploit?

Which deployed versions are affected?