Vulnerability in IBM DataPower Gateway 10.6.0

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.3

[ Description ]Official description

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL16 Oct 2026NCSC-2026-0431

  Vulnerabilities fixed in IBM DataPower Gateway and underlying components Translated from Dutch

  Probability/damage M/HCVE-2023-53781CVE-2025-14087CVE-2025-14512+199 more CVEs
• BSI CERT-Bund28 Sep 2026WID-SEC-2026-3623

  IBM DataPower Gateway: Multiple vulnerabilities Translated from German

  CVE-2026-31411CVE-2025-39766CVE-2026-46331+199 more CVEs

[ References ]References

• www.ibm.com/support/pages/node/7289790