IBM DataPower Gateway: multiple critical security vulnerabilities (CVE-2026-16340, CVE-2026-14990, etc.)
This text was generated using artificial intelligence (AI).Update 10.08.2026: Additionally, CVE-2026-14990 (CVSS 9.3) and five other critical vulnerabilities with CVSS 9.8 (CVE-2026-15762, CVE-2026-14991, CVE-2026-14992, CVE-2026-14502, CVE-2026-14269) have been disclosed. See details below.
IBM has disclosed the vulnerability for IBM DataPower Gateway CVE-2026-16340 , documented in the IBM Security Advisory. It carries a CVSS score of 9.8. Affected gateways can be exploited over the network without prior authentication to execute arbitrary code.
According to IBM, the cause lies in an out-of-bounds write of the category CWE-787 in the parser for RFC2047 encoded-word inputs. Specifically crafted inputs can trigger the fault.
The CVSS vector for CVE-2026-16340 classifies the vulnerability as exploitable over the network. It has a low attack complexity, no required permissions, and no user interaction. Confidentiality, integrity, and availability are each rated with high impact.
Corrected Versions and Timeline
Corrected versions are available for the affected release streams:
Affected Release Stream
Corrected Version
IBM DataPower Gateway 10.5.0
10.5.0.23
IBM DataPower Gateway 10.6.0
10.6.0.11
IBM DataPower Gateway 10.6 CD
11.0.0.3 (no 10.6 CD fix)
IBM DataPower Gateway 11.0.0
11.0.0.3
IBM has released fixes for CVE-2026-16340 and the five additional critical vulnerabilities with CVSS 9.8 on September 28, 2026 . The CVE release was made on October 08, 2026. No active exploitation is documented for any of the vulnerabilities.
For release stream 10.6 CD, IBM notes in bulletin 7289775 none corrected 10.6 CD version; instead, 11.0.0.3 is specified as the fix release. Organizations using 10.6 CD should check whether an upgrade to 11.0.0.3 is possible or if temporary measures are required.
CVE-2026-14990: Cross-Site Scripting in Release Stream 10.6.0
IBM DataPower Gateway 10.6.0.0 to 10.6.0.10 is also affected by CVE-2026-14990 a cross-site scripting vulnerability with a CVSS score of 9.3. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. The vulnerability requires user interaction, but allows a remote, unauthenticated attacker to compromise confidentiality and integrity with high impact. The scope is rated as „Changed.“.
According to IBM bulletin 7289790 (published on September 28, 2026), CVE-2026-14990 has been fixed in version 10.6.0.11 .
CVE-2026-15762, CVE-2026-14991, CVE-2026-14992, CVE-2026-14502, CVE-2026-14269: five additional critical vulnerabilities
IBM has disclosed five additional critical vulnerabilities, each in the same security bulletin 7289775. CVSS 9.8 All five affect the same release streams as CVE-2026-16340 and are fixed in the same corrected versions (10.5.0.23, 10.6.0.11, 11.0.0.3). The CVSS vector is identical for all five: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — Network-based, low complexity, no authentication, no user interaction, high impact on confidentiality, integrity, and availability.
CVE-2026-15762: Out-of-Bounds Write
CVE-2026-15762 (CWE-787) is an out-of-bounds write. A remote attacker can execute arbitrary code on the affected system. IBM provides no further details on the cause.
CVE-2026-14991: Buffer Overflow with discrepancy in description
CVE-2026-14991 (CWE-787) is a buffer overflow due to faulty boundary checking. IBM describes the attacker in the bulletin summary as local user, but evaluates the vulnerability with the network vector AV:N and CVSS 9.8. This discrepancy between description and CVSS vector is included in IBM's information and is reproduced here unchanged. Organizations should consult the IBM bulletin to clarify the actual exploitability.
CVE-2026-14992: Buffer Overflow
CVE-2026-14992 (CWE-787) is a buffer overflow. IBM does not provide further details on the cause or the attack vector.
CVE-2026-14502: empty passwords in LDAP authentication
CVE-2026-14502 (CWE-287) affects LDAP authentication. Empty passwords are not rejected. A remote attacker can gain administrative access to the system.
CVE-2026-14269: Heap-Based Buffer Overflow
CVE-2026-14269 (CWE-122 according to NVD) is a heap-based buffer overflow. An unauthenticated remote attacker can execute arbitrary code.
No active exploitation is documented for any of the five vulnerabilities. IBM does not mention any workarounds.
Prioritization of Remediation
Organizations should first determine if any of the affected release versions are in use. Then, the scheduled corrected version for the respective release stream should be planned and the achieved update status should be verified.
Corrected versions are available for release streams 10.5.0, 10.6.0, and 11.0.0 (10.5.0.23, 10.6.0.11, 11.0.0.3). For the 10.6 CD release stream, IBM's bulletin 7289775 does not mention a corrected 10.6 CD version; instead, 11.0.0.3 is noted as the fix release. Organizations using 10.6 CD should check if an upgrade to 11.0.0.3 is possible or if temporary measures are required.
If an update is not immediately possible, restricting network access to the gateway can be considered as a temporary measure. Additionally, it can be checked whether RFC2047-based inputs from external sources can be filtered or validated. For CVE-2026-14990, inputs that may lead to cross-site scripting should be validated and filtered. For CVE-2026-14502, LDAP authentication should be reviewed to ensure that empty passwords are rejected while awaiting an update.
For further management, IBM DataPower Gateway and associated security alerts should be included in ongoing vulnerability and vendor risk monitoring.
IBM DataPower Gateway is used in many industries as a central API and integration gateway — including financial service providers subject to the EU DORA regulation, as well as operators of critical infrastructures in Germany and Austria, for which NIS-2 implementation obligations apply (in Austria via the NISG). Companies in Switzerland are subject to the revised Information Security Act (ISG) with reporting obligations to BACS. If successful exploitation leads to the processing or leakage of personal data, the GDPR reporting obligation under Art. 33 applies with a 72-hour deadline to the responsible supervisory authority.
IBM DataPower Gateway can be operated as an externally reachable service under its own domain. Therefore, it is primarily relevant which gateways are publicly visible and which software is identifiable there.
LocateRisk supports in External Attack Surface Management in making externally reachable systems and deployed software visible. This visibility can assist in the technical assessment of whether publicly accessible DataPower Gateway instances need to be included in the patch process.
Continuous Vendor Risk Management complements this technical perspective. Security reports from IBM can be included in the assessment of the vendor, while the examination of your own external infrastructure takes place separately.
Am I affected?
Affected are IBM DataPower Gateway 10.5.0, IBM DataPower Gateway 10.6.0, IBM DataPower Gateway 10.6 CD, and IBM DataPower Gateway 11.0.0 in the versions mentioned above; the respective corrected releases are listed in the table above. Those who want to know if IBM DataPower Gateway is even visible in their externally reachable infrastructure can consult the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
CVE-2026-16340 is a critical security vulnerability in IBM DataPower Gateway with a CVSS score of 9.8. It is based on an Out-of-Bounds Write (CWE-787) in the parser for RFC2047 Encoded-Word inputs and allows a remote, unauthenticated attacker to execute arbitrary code on the affected system.
CVE-2026-14990 is a critical cross-site scripting vulnerability in IBM DataPower Gateway 10.6.0.0 to 10.6.0.10 with a CVSS score of 9.3. It allows a remote, unauthenticated attacker to compromise confidentiality and integrity, but requires user interaction.
These five vulnerabilities are also critical (each CVSS 9.8) and affect the same release streams as CVE-2026-16340. CVE-2026-15762 is an Out-of-Bounds Write. CVE-2026-14991 is a Buffer Overflow (IBM describes the attacker as local but rates with Network Vector AV:N). CVE-2026-14992 is a Buffer Overflow with no further details. CVE-2026-14502 affects LDAP authentication (empty passwords are not rejected). CVE-2026-14269 is a Heap-based Buffer Overflow.
For CVE-2026-16340 and the five additional critical vulnerabilities (CVE-2026-15762, CVE-2026-14991, CVE-2026-14992, CVE-2026-14502, CVE-2026-14269), the affected release streams are 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6 (10.6 CD), and 11.0.0.0 to 11.0.0.2. For CVE-2026-14990, the affected versions are 10.6.0.0 to 10.6.0.10. IBM provides corrected versions for streams 10.5.0, 10.6.0, and 11.0.0: 10.5.0.23, 10.6.0.11, and 11.0.0.3. IBM does not specify a corrected 10.6 CD version; instead, 11.0.0.3 is indicated as the fix release.
The primary protection consists of promptly updating to the respective corrected version. Additionally, it can be checked whether network access to the gateway can be restricted and whether RFC2047-based inputs from external sources can be filtered while an update is still pending. For CVE-2026-14990, inputs that may lead to cross-site scripting should be validated and filtered. For CVE-2026-14502, LDAP authentication should be verified and it should be ensured that empty passwords are rejected.
Status: October 09, 2026. This contribution is for general informational purposes only and does not constitute legal, security, or action advice in individual cases. The IT security situation and patch availability may have changed since publication; the linked vendor advisory is always the authoritative source. Despite careful research, we make no guarantee of the accuracy, correctness, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-16340
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français