IBM DataPower Gateway: Use-after-free causing denial of service and information leak
Summary
A use-after-free flaw (CWE-416) in IBM DataPower Gateway can be triggered remotely. IBM's vector shows no authentication required, but high attack complexity. A successful attack can crash the service (denial of service) and expose sensitive information. IBM rates the issue 6.5 (Medium), while the NVD record provided here shows 9.1 (Critical).
Affected
- IBM DataPower Gateway 10.5.0.0 through 10.5.0.22
- IBM DataPower Gateway 10.6.0.0 through 10.6.0.10
- IBM DataPower Gateway 10.6.1 through 10.6.6
- IBM DataPower Gateway 11.0.0.0 through 11.0.0.2
Fixed in
- Upgrade 10.5.0.x to 10.5.0.23 or later
- Upgrade 10.6.0.x to 10.6.0.11 or later
- Upgrade 10.6.1 to 10.6.6 to 11.0.0.3 or later
- Upgrade 11.0.0.x to 11.0.0.3 or later
Workaround
Unknown. No vendor-documented workaround is available.
- Restrict access to the management and service interfaces to trusted networks until the fix is applied.
Exploitation
- No known exploitation in the wild, per the CISA SSVC assessment (exploitation: none, automatable: no) and the trackers reviewed.
- No public proof-of-concept found at the time of review.
Our recommendation
- Inventory all DataPower Gateway instances and compare their versions with the affected ranges.
- Upgrade to the fixed versions listed above as soon as possible.
- Until patched, make sure gateway endpoints are not reachable from the internet.
- Monitor for crashes or restarts of the gateway service and check the CVSS rating against your own risk assessment.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin: IBM DataPower Gateway affected by multiple CVEs www.ibm.com
- VulDB CVE-2026-14508 vuldb.com
- Vulners (Rapid7) CVE-2026-14508 vulners.com
- HOL Guard CVE-2026-14508 hol.org
- Strix CVE-2026-14508 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:13.
Original description (NVD)
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.