IBM DataPower Gateway Server-Side Request Forgery Vulnerability (CVE-2026-14521) Advisory

IBM DataPower Gateway Server-Side Request Forgery Vulnerability (CVE-2026-14521) Vulnerability Overview IBM DataPower Gateway contains a Server-Side Request Forgery (SSRF) vulnerability. Attackers may leverage this vulnerability to send unauthorized requests, leading to network enumeration or facilitating other attacks. CVEID: CVE-2026-14521 CWE: CWE-918: Server-Side Request Forgery (SSRF) CVSS Base Score: 4.9 Affected Products Affected products and versions include: IBM DataPower Gateway 10.6.0.1 - 10.6.6 IBM DataPower Gateway 10.6.0.0 - 10.6.0.10 IBM DataPower Gateway 11.0.0.0 - 11.0.0.2 IBM DataPower Gateway 10.5.0.0 - 10.5.0.22 Remediation IBM strongly recommends upgrading to the following versions as soon as possible: IBM DataPower Gateway 10.6.0.1 - 10.6.6: Fixed in version 11.0.0.3 IBM DataPower Gateway 10.6.0.0 - 10.6.0.10: Fixed in version 10.6.0.11 IBM DataPower Gateway 11.0.0.0 - 11.0.0.2: Fixed in version 11.0.0.3 IBM DataPower Gateway 10.5.0.0 - 10.5.0.22: Fixed in version 10.5.0.23 References Complete CVSS V3 Guide On-line Calculator v3 Related Resources IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard” intended to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores “as is,” without any express or implied warranties. It is the customer’s responsibility to assess the impact of any actual or potential security vulnerabilities. IBM regularly updates the records of known vulnerabilities for components included in its product portfolio. As part of this effort, IBM identifies previously unreported packages, regardless of their CVE dates. The inclusion of older CVEIDs does not indicate that IBM used the referenced products since those dates, nor that IBM was aware of the vulnerabilities at that time. We are working to keep customers informed of the vulnerabilities we are aware of. The cited “Affected Products and Versions” are intended solely for IBM-supported and in-support products and versions. Therefore, the citation of unsupported or extended support products and versions in this security announcement does not constitute an IBM certification that they are unaffected by vulnerabilities. The citation of one or more unsupported versions in this security announcement imposes no obligation on IBM to provide fixes for unsupported or extended support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM DataPower Gateway Server-Side Request Forgery Vulnerability (CVE-2026-14521) Advisory

More from this source