CVE-2026-14991
IBM DataPower Gateway Out-of-bounds Write
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
Affected versions
- IBM DataPower Gateway 10.6CD
From 10.6.1 · through 10.6.6
- IBM DataPower Gateway 10.6.0
From 10.6.0.0 · through 10.6.0.10
- IBM DataPower Gateway 11.0.0
From 11.0.0.0 · through 11.0.0.2
- IBM DataPower Gateway 10.5.0
From 10.5.0.0 · through 10.5.0.22