CVE-2026-14508: IBM DataPower Gateway Use After Free

Q: Which deployments are affected?

Affected release ranges are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2.

Q: Does exploitation require authentication or user interaction?

No. The supplied vector indicates network-based exploitation with no privileges required and no user interaction.

Q: What could an attacker achieve?

A remote attacker could cause a denial of service and obtain sensitive information. Integrity impact is listed as none.

Q: Is exploitation expected to be straightforward?

The attack complexity is rated high, indicating exploitation requires conditions beyond simply sending a basic network request.

Published Sep 28, 2026

Updated

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.

Other sources

IBM DataPower Gateway could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.

— IBM

Affected Software

4 affected components

IBM DataPower Gateway 10.6CD<=10.6.1 - 10.6.6

IBM DataPower Gateway 10.6.0<=10.6.0.0 - 10.6.0.10

IBM DataPower Gateway 11.0.0<=11.0.0.0 - 11.0.0.2

IBM DataPower Gateway 10.5.0<=10.5.0.0 - 10.5.0.22

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM DataPower Gateway 10.6CD to a version that resolves this vulnerability.
Fixed in 11.0.0.3
Upgrade
Upgrade IBM DataPower Gateway 10.6.0 to a version that resolves this vulnerability.
Fixed in 10.6.0.11
Upgrade
Upgrade IBM DataPower Gateway 11.0.0 to a version that resolves this vulnerability.
Fixed in 11.0.0.3
Upgrade
Upgrade IBM DataPower Gateway 10.5.0 to a version that resolves this vulnerability.
Fixed in 10.5.0.23

Event History

Sep 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 8, 2026

CVE Published

via MITRE·02:03 PM

Data Sourced

via MITRE·02:03 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7289775

Frequently Asked Questions

Which deployments are affected?

Affected release ranges are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2.

Does exploitation require authentication or user interaction?

No. The supplied vector indicates network-based exploitation with no privileges required and no user interaction.

What could an attacker achieve?

A remote attacker could cause a denial of service and obtain sensitive information. Integrity impact is listed as none.

Is exploitation expected to be straightforward?

The attack complexity is rated high, indicating exploitation requires conditions beyond simply sending a basic network request.

CVE-2026-14508: IBM DataPower Gateway Use After Free

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What could an attacker achieve?

Is exploitation expected to be straightforward?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What could an attacker achieve?

Is exploitation expected to be straightforward?