Threat level Severe
Contact
Critical 9.8
CVE-2026-14988

IBM Datapower Gateway — buffer overflow.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.

WeaknessCWE-125: Out-of-bounds read
Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
0.3%
Higher than 17% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.

What to do

  1. 01Check whether you run IBM Datapower Gateway, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCVE-2026-1146259.9Arista VeloCloud OrchestratorCVE-2026-1114979.8Google Brotli
Vendor
IBM47 CVEs in 30 days
All IBM CVEs

Other CVEs in IBM Datapower Gateway

8 more CVEs

All IBM Datapower Gateway CVEs
9.8IBM Datapower Gateway — buffer overflow.EPSS 0.3%9.8IBM Datapower Gateway — authentication bypass.EPSS 0.4%9.1IBM Datapower Gateway — use-after-free.EPSS 0.3%9.8IBM Datapower Gateway — remote code execution.EPSS 0.4%9.8IBM Datapower Gateway — remote code execution.EPSS 0.5%9.8IBM Datapower Gateway — remote code execution.EPSS 0.4%