critical9.3
CVE-2026-14990
IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting.
Impact
IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Affected products
| Product | Affected versions |
|---|---|
| IBM DataPower Gateway 10.6.0.0 | through 10.6.0.10 |
Versions were read from the advisory text. No structured product data has been published for this record yet.