{"id":"CVE-2026-14497","published":"2026-10-08T15:17:49.013","lastModified":"2026-10-14T23:58:32.363","description":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-347"],"vendors":["ibm"],"products":["datapower gateway"],"references":[{"url":"https://www.ibm.com/support/pages/node/7289775","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM DataPower Gateway suffers from a cryptographic signature verification flaw that allows authenticated attackers to bypass security restrictions, potentially leading to unauthorized access to protected resources.","exploitability":"Exploitation requires an authenticated user with access to the DataPower Gateway interface, making it moderately difficult to achieve but not highly complex.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive data and services protected by the DataPower Gateway, potentially affecting multiple applications and systems that rely on its security controls.","remediation":"Upgrade to IBM DataPower Gateway 10.5.0.23 or later, or 10.6.7 or later, or 10.6.0.11 or later, or 11.0.0.3 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","gateway","crypto","api"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:20:26.011Z"}}