IBM DataPower GW 10.5-11.0 Auth Bypass via Improper Crypto Sig Verif
CVE-2026-14497 Published on October 8, 2026
IBM DataPower Gateway Improper Verification of Cryptographic Signature
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.
Vulnerability Analysis
CVE-2026-14497 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Improper Verification of Cryptographic Signature
The software does not verify, or incorrectly verifies, the cryptographic signature for data.
Products Associated with CVE-2026-14497
Want to know whenever a new CVE is published for IBM products? stack.watch will email you.
Affected Versions
IBM DataPower Gateway 10.6CD:- Version 10.6.1, <= 10.6.6 is affected.
- Version 10.6.0.0, <= 10.6.0.10 is affected.
- Version 11.0.0.0, <= 11.0.0.2 is affected.
- Version 10.5.0.0, <= 10.5.0.22 is affected.