CVEvulnerability

CVE-2026-14905

8.2 HIGH Published 2026-10-08 Modified 2026-10-15 Official page ↗
Status
Analyzed
Published
2026-10-08
Last modified
2026-10-15
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weaknesses
CWE-611

Description

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Affected configurations

• ibm datapower gateway (>= 10.5.0.0 < 10.5.0.23) • ibm datapower gateway (>= 10.6.0.0 < 10.6.0.11) • ibm datapower gateway (>= 10.6.1.0 < 11.0.0.3) • ibm datapower gateway (>= 11.0.0.0 < 11.0.0.3)

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References