CVE-2026-14992: IBM DataPower Gateway Out-of-bounds Write

Q: Which deployments should be prioritized for investigation?

Prioritize IBM DataPower Gateway instances running 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, or 11.0.0.0 through 11.0.0.2. The vulnerability is rated critical with network attack vector, low attack complexity, and no required privileges or user interaction.

Q: Does exploitation require an authenticated account or user action?

No. The supplied CVSS vector indicates that exploitation can be attempted over the network without privileges and without user interaction.

Q: What is the potential impact if an affected gateway is exploited?

The vulnerability is a buffer overflow/out-of-bounds write with high impact to confidentiality, integrity, and availability according to the CVSS vector.

Published Sep 28, 2026

Updated

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.

Other sources

IBM DataPower Gateway vulnerable to buffer overflow

— IBM

Affected Software

4 affected components

IBM DataPower Gateway 10.6CD<=10.6.1 - 10.6.6

IBM DataPower Gateway 10.6.0<=10.6.0.0 - 10.6.0.10

IBM DataPower Gateway 11.0.0<=11.0.0.0 - 11.0.0.2

IBM DataPower Gateway 10.5.0<=10.5.0.0 - 10.5.0.22

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM DataPower Gateway 10.6CD to a version that resolves this vulnerability.
Fixed in 11.0.0.3
Upgrade
Upgrade IBM DataPower Gateway 10.6.0 to a version that resolves this vulnerability.
Fixed in 10.6.0.11
Upgrade
Upgrade IBM DataPower Gateway 11.0.0 to a version that resolves this vulnerability.
Fixed in 11.0.0.3
Upgrade
Upgrade IBM DataPower Gateway 10.5.0 to a version that resolves this vulnerability.
Fixed in 10.5.0.23

Event History

Sep 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 8, 2026

CVE Published

via MITRE·01:58 PM

Data Sourced

via MITRE·01:58 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7289775

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Prioritize IBM DataPower Gateway instances running 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, or 11.0.0.0 through 11.0.0.2. The vulnerability is rated critical with network attack vector, low attack complexity, and no required privileges or user interaction.

Does exploitation require an authenticated account or user action?

No. The supplied CVSS vector indicates that exploitation can be attempted over the network without privileges and without user interaction.

What is the potential impact if an affected gateway is exploited?

The vulnerability is a buffer overflow/out-of-bounds write with high impact to confidentiality, integrity, and availability according to the CVSS vector.

CVE-2026-14992: IBM DataPower Gateway Out-of-bounds Write

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Does exploitation require an authenticated account or user action?

What is the potential impact if an affected gateway is exploited?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Does exploitation require an authenticated account or user action?

What is the potential impact if an affected gateway is exploited?