IBM DataPower Gateway 10.5-11.0 Heap Buffer Overflow (Unauth Remote Exec)
CVE-2026-14269 Published on October 8, 2026
IBM DataPower Gateway Buffer Overflow
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.
Vulnerability Analysis
CVE-2026-14269 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Products Associated with CVE-2026-14269
Want to know whenever a new CVE is published for IBM products? stack.watch will email you.
Affected Versions
IBM DataPower Gateway 10.6CD:- Version 10.6.1, <= 10.6.6 is affected.
- Version 10.6.0.0, <= 10.6.0.10 is affected.
- Version 11.0.0.0, <= 11.0.0.2 is affected.
- Version 10.5.0.0, <= 10.5.0.22 is affected.