CVE-2026-14888 – IBM DataPower Gateway 10.6CD
“When the gateway breaks, every service behind it is exposed, and 22 flaws give attackers 22 ways through.”
This IBM DataPower Gateway update fixes 22 vulnerabilities across versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. Six are Critical. CVE-2026-14269, CVE-2026-14502, CVE-2026-14991, CVE-2026-14992, CVE-2026-15762, and CVE-2026-16340 each have a CVSS score of 9.8, Critical severity. These flaws let an unauthenticated remote attacker run arbitrary code through heap overflows and out-of-bounds writes, including one in the RFC2047 encoded-word parser. One of them lets an attacker gain administrative access because LDAP authentication accepts empty passwords.
The remaining 16 are High severity. CVE-2026-16159 and CVE-2026-16163 have a CVSS score of 8.6, High severity. CVE-2026-14496 and CVE-2026-15824 have a CVSS score of 8.2, High severity. CVE-2026-14888 and CVE-2026-15784 have a CVSS score of 8.1, High severity. CVE-2026-15781 has a CVSS score of 8.0, High severity. CVE-2026-15819, CVE-2026-16161, CVE-2026-16164, CVE-2026-16165, CVE-2026-16167, CVE-2026-16170, CVE-2026-16178, and CVE-2026-16179 each have a CVSS score of 7.5, High severity. CVE-2026-16181 has a CVSS score of 7.4, High severity. These flaws enable remote code execution, information disclosure, authorization bypass, memory corruption, and denial of service against the gateway. Patch DataPower Gateway the same day.
Key Details
- Attack Vector
- Network
- Attack Complexity
- High
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-122