CVE-2026-14521: IBM DataPower Gateway affected by server-side request forgery
Published Oct 8, 2026
·Updated
IBM DataPower Gateway
Affected Software
5 affected components
IBM DataPower Gateway 10.6CD<=10.6.1 - 10.6.6
IBM DataPower Gateway 10.6.0<=10.6.0.0 - 10.6.0.10
IBM DataPower Gateway 11.0.0<=11.0.0.0 - 11.0.0.2
IBM DataPower Gateway 10.5.0<=10.5.0.0 - 10.5.0.22
IBM DataPower Gateway>=10.5.0.0<=10.5.0.22, >=10.6.1<=10.6.6, >=10.6.0.0<=10.6.0.10, >=11.0.0.0<=11.0.0.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM DataPower Gatewayto a version that resolves this vulnerability.Fixed in 10.6.0.11 - Upgrade
Upgrade
IBM DataPower Gatewayto a version that resolves this vulnerability.Fixed in 11.0.0.3 - Upgrade
Upgrade
IBM DataPower Gatewayto a version that resolves this vulnerability.Fixed in 10.5.0.23
Event History
Oct 8, 2026
CVE Published
via MITRE·01:04 PM
Data Sourced
via MITRE·01:04 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Data Sourced
via IBM·01:19 PM
DescriptionAffected Software
Frequently Asked Questions
1
Does exploitation require prior access?
Yes. Exploitation requires an authenticated attacker with privileges on the affected DataPower Gateway system.
2
What could an attacker do through this issue?
An attacker may cause the gateway to send unauthorized requests from the system. This could enable network enumeration or facilitate additional attacks against reachable resources.
3
Which release lines are affected?
Affected versions are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2.