Patch Forecast
Amber warning
Patch this week.

CVE-2026-14508

Ibm Datapower Gateway: use-after-free can lead to denial of service

Risk score
63/100
CVSS
9.1 v3.1
Exploit chance (30 days)
0.3%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.
Affected
Ibm Datapower Gateway
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Ibm Datapower GatewayTHE FLAWSTHE FIXCVE-2026-14508Use-after-free can lead todenial of serviceCVSS 9.1 · EPSS 0%CVE-2026-15762Out-of-bounds write can leadto remote code executionCVSS 9.8 · EPSS 1%CVE-2026-16340Out-of-bounds write can leadto remote code executionCVSS 9.8 · EPSS 0%CVE-2026-14269Heap buffer overflow can leadto remote code executionCVSS 9.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedIbm Datapower GatewayAMBER · PATCH THIS WEEKIbm DatapowerGatewayIBM DataPower Gateway10.5.0.0 through 10.5.0.22, 10.6.1through 10.6.6, 10.6.0.0 through10.6.0.10, and 11.0.0.0 through11.0.0.2 could allow a remoteattacker to execute arbitrarycode due to an out-of-bounds…Where it standsNo known exploitationCONNECTS TOSame weaknessUse-after-free (CWE-416)399 other warnings in 30 days →Same productEarlier Ibm Datapower Gateway warnings35 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Ibm Datapower Gateway: Amber, patch this week. IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

The flaws

  • CVE-2026-14508: Use-after-free can lead to denial of service (CVSS 9.1 · EPSS 0%)
  • CVE-2026-15762: Out-of-bounds write can lead to remote code execution (CVSS 9.8 · EPSS 1%)
  • CVE-2026-16340: Out-of-bounds write can lead to remote code execution (CVSS 9.8 · EPSS 0%)
  • CVE-2026-14269: Heap buffer overflow can lead to remote code execution (CVSS 9.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Ibm Datapower Gateway

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.1 critical
  • Remotely exploitable without logging in

References

Original description

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.

Last activity 8 Oct 2026. Patch Forecast updates every hour.