Tag
#IBM DataPower Gateway
Understanding and Defending Against CVE-2026-14990: Cross-Site Scripting in IBM DataPower Gateway
CVE-2026-14990 is a critical cross-site scripting (XSS) vulnerability in IBM DataPower Gateway 10.6.0.0 through 10.6.0.10. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session. The vulnerability has a CVSS score of 9.3, indicating a high severity. Understanding the root cause, attack surface, and exploitation mechanics is crucial for defenders to implement effective mitigations and detections.
Critical Remote Code Execution Vulnerability in IBM DataPower Gateway: CVE-2026-15762
A critical vulnerability, CVE-2026-15762, with a CVSS score of 9.8, was discovered in IBM DataPower Gateway. This vulnerability allows a remote attacker to execute arbitrary code due to an out-of-bounds write. Affected versions include 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. Immediate patching is recommended to prevent potential exploitation.