CVE-2026-14988
Ibm Datapower Gateway: out-of-bounds read
- Risk score
- 67/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.
- Affected
- Ibm Datapower Gateway
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Ibm Datapower Gateway: Amber, patch this week. IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
The flaws
- CVE-2026-14988: Out-of-bounds read (CVSS 9.8 · EPSS 0%)
- CVE-2026-15762: Out-of-bounds write can lead to remote code execution (CVSS 9.8 · EPSS 1%)
- CVE-2026-16340: Out-of-bounds write can lead to remote code execution (CVSS 9.8 · EPSS 0%)
- CVE-2026-14269: Heap buffer overflow can lead to remote code execution (CVSS 9.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Ibm Datapower Gateway
Where it stands
- No known exploitation
Connects to
- Same weakness: Out-of-bounds read (CWE-125). 373 other warnings in 30 days
- Same product: Earlier Ibm Datapower Gateway warnings. 35 in the last 90 days
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.
Last activity 8 Oct 2026. Patch Forecast updates every hour.