IBM DataPower Gateway Vulnerability Advisory: CVE-2026-14507/16169 Fixes

Vulnerability Overview IBM DataPower Gateway addressed multiple vulnerabilities in version 11.0.0.3. Specifically, these include: 1. CVE-2026-14507 - Description: IBM DataPower Gateway may allow a remote authenticated attacker to cause a denial of service via improper memory allocation during key derivation. - CWE: CWE-787: Out-of-bounds Write - CVSS Base Score: 7.7 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) 2. CVE-2026-16169 - Description: IBM DataPower Gateway may allow a remote attacker to cause a denial of service via uncontrolled resource consumption. - CWE: CWE-400: Uncontrolled Resource Consumption - CVSS Base Score: 7.5 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Affected Scope Affected Product: IBM DataPower Gateway Affected Versions: 11.0.0, 10.0.0, 11.0.0.2 Remediation Recommendation: IBM strongly advises upgrading as soon as possible. Known Issue: DT501893 Fixed Version: 11.0.0.3 Additional Information Initial Publication Date: September 28, 2026 Document ID: 7289798 Operating System: Firmware References Complete CVSS v3 Guide On-line Calculator v3 Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard" intended to communicate vulnerability severity and assist in determining the urgency and priority of response. IBM provides the CVSS rating "as is," without any express or implied warranties. Customers are responsible for assessing the impact of any actual or potential security vulnerabilities. IBM periodically updates records for components within its product portfolio but assumes no liability due to product references. --- Note: POC code or exploitation code is not included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

IBM DataPower Gateway Vulnerability Advisory: CVE-2026-14507/16169 Fixes

More from this source