CVE-2026-14905: ibm datapower_gateway
CVSS: 8.2v3.1HighAnalyzed
Published 08-10-2026Last modified 10-10-2026
Vulnerability summary
CVE-2026-14905 is a high (CVSS 8.2) vulnerability in ibm datapower_gateway. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.9% of scored vulnerabilities.
CVSS score
8.2/10
010
High · v3.1 (CVE.org)EPSS score
0.34%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 08-10-2026PublishedVulnerability first disclosed.
- 10-10-2026Last modifiedVulnerability information updated.
Description
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 8.2Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:LSourcesAll 2 agree
- NVDNIST8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
09-10-202621-10-2026
EPSS score0.34%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ibm5 products
- datapower_gateway≥ 10.5.0.0, < 10.5.0.23 | ≥ 10.6.0.0, < 10.6.0.11 | ≥ 10.6.1.0, < 11.0.0.3 | ≥ 11.0.0.0, < 11.0.0.3
- datapower gateway 10.5.0≥ 10.5.0.0, ≤ 10.5.0.22
- datapower gateway 10.6.0≥ 10.6.0.0, ≤ 10.6.0.10
- datapower gateway 10.6cd≥ 10.6.1, ≤ 10.6.6
- datapower gateway 11.0.0≥ 11.0.0.0, ≤ 11.0.0.2
1 vendor · 5 products