by Kastro
Paper/Archive/CVE-2026-14988

CVE-2026-14988

IBM DataPower Gateway 10.6CD — IBM DataPower Gateway Out-of-bounds Read

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
33
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 17.3.173 × 203.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.

Affected

ProductAffectedFixed inSource
DataPower Gateway 10.6CD10.6.1 – 10.6.6–CNA
DataPower Gateway 10.6.010.6.0.0 – 10.6.0.10–CNA
DataPower Gateway 11.0.011.0.0.0 – 11.0.0.2–CNA
DataPower Gateway 10.5.010.5.0.0 – 10.5.0.22–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ibm (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

patchibm.com/support/pages/node/7289775