CVE-2026-14991

Summary

The flaw is a buffer overflow in IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.1 to 10.6.6, 10.6.0.0 to 10.6.0.10, and 11.0.0.0 to 11.0.0.2, allowing local users to execute arbitrary code by overflowing a buffer.

Exploitability

Exploitation requires local access and knowledge of the specific buffer overflow condition. Precondition is the presence of a local user with the ability to send crafted input.

Blast radius

If exploited, this flaw could lead to complete system compromise, allowing the attacker to execute arbitrary code with the privileges of the DataPower Gateway service.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM DataPower Gateway 10.5.0.23 or later, 10.6.7 or later, or 11.0.1.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.