CVE-2026-14990: IBM DataPower Gateway affected by cross-site scripting

Q: Which deployments are affected?

IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 are identified as vulnerable. The provided information does not identify other versions or deployment configurations.

Q: What does an attacker need to exploit this issue?

The issue can be initiated by an unauthenticated user, but exploitation requires user interaction. The attacker embeds arbitrary JavaScript in the Web UI, targeting a trusted user session.

Q: What is the likely impact if exploitation succeeds?

Injected JavaScript can alter intended Web UI functionality and may disclose credentials from a trusted session. The supplied severity vector rates confidentiality and integrity impact as high, with no availability impact.

Published Sep 28, 2026

Updated

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Other sources

IBM DataPower Gateway vulnerable to open redirect

— IBM

Affected Software

2 affected components

IBM DataPower Gateway>=10.6.0.0<=10.6.0.10

IBM DataPower Gateway 10.6.0<=10.6.0.0 - 10.6.0.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM DataPower Gateway to a version that resolves this vulnerability.
Fixed in 10.6.0.11

Event History

Sep 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 8, 2026

CVE Published

via MITRE·01:53 PM

Data Sourced

via MITRE·01:53 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7289790

Frequently Asked Questions

Which deployments are affected?

IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 are identified as vulnerable. The provided information does not identify other versions or deployment configurations.

What does an attacker need to exploit this issue?

The issue can be initiated by an unauthenticated user, but exploitation requires user interaction. The attacker embeds arbitrary JavaScript in the Web UI, targeting a trusted user session.

What is the likely impact if exploitation succeeds?

Injected JavaScript can alter intended Web UI functionality and may disclose credentials from a trusted session. The supplied severity vector rates confidentiality and integrity impact as high, with no availability impact.

CVE-2026-14990: IBM DataPower Gateway affected by cross-site scripting

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?