HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-14905 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....

·Source: NIST NVD

Updated:

Executive Summary

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Analysis

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. CVSS Score: 8.2. Published: 2026-10-08T15:17:49.837.

Indicators of Compromise (7)

CVE (1)
CVE-2026-14905
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

JP Morgan brings JPM Coin to Ethereum

JP Morgan has brought its deposit token product, JPM Coin, to the Ethereum layer 1 blockchain network.

Finextra
MEDIUMVulnerabilityNEW

Boston Children’s Health Physicians; XTIUM Settle Alleged HIPAA Violations for $2.7M

Boston Children’s Health Physicians (BCHP) and the managed IT service provider XTIUM have agreed to settle an investigation by the […] The post Boston Children’s Health Physicians; XTIUM Settle Alleged HIPAA Violations for $2.7M appeared first on The HIPAA Journal .

HIPAA Journal
MEDIUMVulnerabilityNEW

Microsoft fixes game, app crashes caused by recent Windows update

Microsoft has resolved a bug that caused games and apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 Windows 11 preview update (KB5124010). [...]

BleepingComputer