Patchfirst
Patchfirst
CVE-2026-14990 Critical · 9.3 EPSS 0.3%

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting

IBM · DataPower Gateway 10.6.0

Summary

The flaw is a cross-site scripting vulnerability in the Web UI of IBM DataPower Gateway 10.6.0.0 through 10.6.0.10, where input is not properly neutralized during web page generation. An attacker can embed arbitrary JavaScript into the Web UI without authenticating, but a user must interact with the crafted content, and successful exploitation can alter the intended functionality and potentially lead to credential disclosure within a trusted session.

Official description · NVD

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Breakdown
13.7 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 8 Oct 2026. No public exploit code or confirmed exploitation is recorded.

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 12 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

1 link, grouped by NVD tag

Other 1

ibm.com/support/pages/node/7289790
↑ ↓ chooseEnter openEsc close