Understanding and Defending Against CVE-2026-14990: Cross-Site Scripting in IBM DataPower Gateway
CVE-2026-14990 is a critical cross-site scripting (XSS) vulnerability in IBM DataPower Gateway 10.6.0.0 through 10.6.0.10. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session. The vulnerability has a CVSS score of 9.3, indicating a high severity. Understanding the root cause, attack surface, and exploitation mechanics is crucial for defenders to implement effective mitigations and detections.