Vulnerability in IBM DataPower Gateway 10.6CD

[ Description ]Official description

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL16 Oct 2026NCSC-2026-0431

  Vulnerabilities fixed in IBM DataPower Gateway and underlying components Translated from Dutch

  Probability/damage M/HCVE-2023-53781CVE-2025-14087CVE-2025-14512+199 more CVEs
• BSI CERT-Bund28 Sep 2026WID-SEC-2026-3623

  IBM DataPower Gateway: Multiple vulnerabilities Translated from German

  CVE-2026-31411CVE-2025-39766CVE-2026-46331+199 more CVEs

[ References ]References

• www.ibm.com/support/pages/node/7289775Vendor Advisory