CVE-2026-14991: IBM DataPower Gateway Out-of-bounds Write
Published Sep 28, 2026
·Updated
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
Affected Software
4 affected components
IBM DataPower Gateway 10.6CD<=10.6.1 - 10.6.6
IBM DataPower Gateway 10.6.0<=10.6.0.0 - 10.6.0.10
IBM DataPower Gateway 11.0.0<=11.0.0.0 - 11.0.0.2
IBM DataPower Gateway 10.5.0<=10.5.0.0 - 10.5.0.22
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM DataPower Gatewayto a version that resolves this vulnerability.Fixed in 11.0.0.3 - Upgrade
Upgrade
IBM DataPower Gatewayto a version that resolves this vulnerability.Fixed in 10.6.0.11 - Upgrade
Upgrade
IBM DataPower Gatewayto a version that resolves this vulnerability.Fixed in 10.5.0.23
Event History
Sep 28, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
Affected Software
Oct 8, 2026
CVE Published
via MITRE·01:50 PM
Data Sourced
via MITRE·01:50 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness