CVE-2026-14269

Summary

The flaw is a heap-based buffer overflow in IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.1 to 10.6.6, 10.6.0.0 to 10.6.0.10, and 11.0.0.0 to 11.0.0.2, allowing unauthenticated attackers to execute arbitrary code by overflowing a buffer.

Exploitability

Exploitation is relatively straightforward given the unauthenticated nature and the buffer overflow vulnerability, requiring the attacker to send a crafted payload to the affected gateway.

Blast radius

If exploited, this vulnerability could result in full system compromise, allowing an attacker to execute arbitrary code and potentially gain control over the DataPower Gateway and its connected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM DataPower Gateway 10.5.0.23 or later, 10.6.7 or later, 10.6.11 or later, and 11.0.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.