---
id: CVE-2026-14905
title: >-
  IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6,
  10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an
  XML external entity injection (XXE) attack when processing XML data
summary: >-
  IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6,
  10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an
  XML external entity injection (XXE) attack when processing XML data. A remote
  attacker…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L'
cwe:
  - CWE-611
vendor: ibm
product: datapower_gateway
affected:
  - 'datapower_gateway >= 10.5.0.0, < 10.5.0.23'
  - 'datapower_gateway >= 10.6.0.0, < 10.6.0.11'
  - 'datapower_gateway >= 10.6.1.0, < 11.0.0.3'
  - 'datapower_gateway >= 11.0.0.0, < 11.0.0.3'
patched:
  - datapower_gateway 11.0.0.3
published: '2026-10-08'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:12:05.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-14905'
references:
  - url: 'https://www.ibm.com/support/pages/node/7289775'
    label: psirt@us.ibm.com
tags:
  - nvd
  - cve.org
epss: 0.00339
epssPercentile: 0.27129
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-10T03:02:32.047244Z'
ingestedAt: '2026-10-08T14:47:16.370Z'
---

## Overview

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

## Affected

- `datapower_gateway >= 10.5.0.0, < 10.5.0.23`
- `datapower_gateway >= 10.6.0.0, < 10.6.0.11`
- `datapower_gateway >= 10.6.1.0, < 11.0.0.3`
- `datapower_gateway >= 11.0.0.0, < 11.0.0.3`

## Remediation

Upgrade past the affected range:

- `datapower_gateway 11.0.0.3`