CVE-2026-14508
Received Received - Intake

Denial of Service in IBM DataPower Gateway

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: IBM Corporation

Description
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-14508
EUVD
EUVD-2026-94994

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
IBM DataPower Gateway 10.6CD 10.6.1
IBM DataPower Gateway 10.6.0 10.6.0.0
IBM DataPower Gateway 11.0.0 11.0.0.0
IBM DataPower Gateway 10.5.0 10.5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free flaw in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. It allows a remote attacker to cause a denial of service and potentially access sensitive information by exploiting a memory management issue.

Detection Guidance

Detection requires checking for IBM DataPower Gateway versions 10.5.0.0-10.5.0.22, 10.6.1-10.6.6, 10.6.0.0-10.6.0.10, or 11.0.0.0-11.0.0.2. Use version check commands like 'show version' in DataPower CLI or inspect system logs for unusual crashes or memory errors.

Impact Analysis

The impact includes system crashes due to denial of service, potential exposure of sensitive data, and disruption of services relying on IBM DataPower Gateway for processing or security functions.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties if affected systems handle regulated data.

Mitigation Strategies

Update IBM DataPower Gateway to a version beyond the affected range (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.6, 10.6.0.0-10.6.0.10, 11.0.0.0-11.0.0.2). Apply patches from IBM as soon as they are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14508. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart