CVE-2026-14905
HIGHCVSS 8.2Description
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Timeline
Published:October 8th, 2026 3:17 PM
Last modified:October 15th, 2026 2:12 AM
CVSS Scoring
CVSS v3: 8.2 (HIGH)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Affected Software
From NVD CPE configuration data
Vendors
ibm
Products
datapower_gateway
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
Source: NIST NVD · Data may lag official sources by up to one minute