CVE-2026-14521

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Score

CVSS 3.1 4.9 Medium

Status

Analyzed - psirt@us.ibm.com

Published

2026-10-08

Last modified

2026-10-15

Weaknesses

CWE-918

Affected products

• Datapower Gateway (Ibm)
• Datapower Gateway 1050 (Ibm)
• Datapower Gateway 1060 (Ibm)
• Datapower Gateway 106cd (Ibm)
• Datapower Gateway 1100 (Ibm)

References

• https://www.ibm.com/support/pages/node/7285636