CVE-2026-14990 – IBM DataPower Gateway 10.6.0
CVSS 9.3
CRITICAL
[2] Critical – Same Day Deployment
“One poisoned page in the admin console can turn a trusted session into a stolen identity.”
This IBM DataPower Gateway update fixes a critical cross-site scripting flaw in the Web UI of versions 10.6.0.0 through 10.6.0.10. CVE-2026-14990 has a CVSS score of 9.3, Critical severity. An unauthenticated attacker can embed arbitrary JavaScript in the Web UI, change how the interface behaves, and expose credentials inside a trusted administrative session.
DataPower sits at the edge of enterprise API and integration traffic, so stolen administrator credentials put the whole gateway at risk. Apply the update to every 10.6.0 deployment now.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-79
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.