CVE-2026-14905: IBM DataPower Gateway XXE

Q: Which deployments are affected?

Affected releases are IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2.

Q: What must an attacker be able to do to exploit this issue?

An attacker needs to be able to remotely submit XML data that the gateway processes. The supplied severity vector indicates no privileges or user interaction are required.

Q: What is the potential impact?

Successful exploitation may expose sensitive information or consume memory resources, potentially degrading availability.

Published Sep 28, 2026

Updated

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Other sources

IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

— IBM

Affected Software

4 affected components

IBM DataPower Gateway 10.6CD<=10.6.1 - 10.6.6

IBM DataPower Gateway 10.6.0<=10.6.0.0 - 10.6.0.10

IBM DataPower Gateway 11.0.0<=11.0.0.0 - 11.0.0.2

IBM DataPower Gateway 10.5.0<=10.5.0.0 - 10.5.0.22

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM DataPower Gateway to a version that resolves this vulnerability.
Fixed in 11.0.0.3
Upgrade
Upgrade IBM DataPower Gateway 10.6.0 to a version that resolves this vulnerability.
Fixed in 10.6.0.11
Upgrade
Upgrade IBM DataPower Gateway 10.5.0 to a version that resolves this vulnerability.
Fixed in 10.5.0.23

Event History

Sep 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 8, 2026

CVE Published

via MITRE·02:02 PM

Data Sourced

via MITRE·02:02 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7289775

Frequently Asked Questions

Which deployments are affected?

Affected releases are IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2.

What must an attacker be able to do to exploit this issue?

An attacker needs to be able to remotely submit XML data that the gateway processes. The supplied severity vector indicates no privileges or user interaction are required.

What is the potential impact?

Successful exploitation may expose sensitive information or consume memory resources, potentially degrading availability.

CVE-2026-14905: IBM DataPower Gateway XXE

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are affected?

What must an attacker be able to do to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker be able to do to exploit this issue?

What is the potential impact?