CVE-2026-14905

Summary

IBM DataPower Gateway suffers from XML external entity injection (XXE) vulnerability that allows remote attackers to access sensitive information and consume memory resources by processing malicious XML data.

Exploitability

Exploitation is relatively straightforward with no special preconditions required, as the vulnerability exists in the XML processing functionality accessible over the network.

Blast radius

The impact could be significant across all affected DataPower Gateway versions, potentially exposing sensitive data and causing resource exhaustion that affects system availability.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM DataPower Gateway 10.5.0.23 or later, or 10.6.7 or later, or 10.6.0.11 or later, or 11.0.0.3 or later to remediate this XXE vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.