CVE-2026-14502: IBM DataPower Gateway Improper Authentication

Q: Which deployments are exposed to this issue?

IBM DataPower Gateway deployments running 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, or 11.0.0.0 through 11.0.0.2 are affected when LDAP authentication is used.

Q: What does an attacker need to exploit the vulnerability?

The attacker needs remote network access to the affected DataPower Gateway authentication interface. No privileges or user interaction are required, and exploitation relies on LDAP authentication accepting an empty password.

Q: What level of access could exploitation provide?

A remote attacker could obtain administrative access to the affected IBM DataPower Gateway. The reported impact includes high confidentiality, integrity, and availability impact.

Published Sep 28, 2026

Updated

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.

Other sources

IBM DataPower Gateway could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.

— IBM

Affected Software

4 affected components

IBM DataPower Gateway 10.6CD<=10.6.1 - 10.6.6

IBM DataPower Gateway 10.6.0<=10.6.0.0 - 10.6.0.10

IBM DataPower Gateway 11.0.0<=11.0.0.0 - 11.0.0.2

IBM DataPower Gateway 10.5.0<=10.5.0.0 - 10.5.0.22

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM DataPower Gateway 10.6CD and 11.0.0 to a version that resolves this vulnerability.
Fixed in 11.0.0.3
Upgrade
Upgrade IBM DataPower Gateway 10.6.0 to a version that resolves this vulnerability.
Fixed in 10.6.0.11
Upgrade
Upgrade IBM DataPower Gateway 10.5.0 to a version that resolves this vulnerability.
Fixed in 10.5.0.23

Event History

Sep 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 8, 2026

CVE Published

via MITRE·02:05 PM

Data Sourced

via MITRE·02:05 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7289775

Frequently Asked Questions

Which deployments are exposed to this issue?

IBM DataPower Gateway deployments running 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, or 11.0.0.0 through 11.0.0.2 are affected when LDAP authentication is used.

What does an attacker need to exploit the vulnerability?

The attacker needs remote network access to the affected DataPower Gateway authentication interface. No privileges or user interaction are required, and exploitation relies on LDAP authentication accepting an empty password.

What level of access could exploitation provide?

A remote attacker could obtain administrative access to the affected IBM DataPower Gateway. The reported impact includes high confidentiality, integrity, and availability impact.

CVE-2026-14502: IBM DataPower Gateway Improper Authentication

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What level of access could exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What level of access could exploitation provide?