CVE-2026-14508 is a use after free flaw in IBM DataPower Gateway, rated 6.5 (medium). IBM says a remote attacker could cause a denial of service and obtain sensitive information. Upgrade to 10.5.0.23, 10.6.0.11 or 11.0.0.3, whichever matches your line. IBM lists no workaround.
What's affected
- Product: IBM DataPower Gateway.
- Affected: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6 (the 10.6 continuous delivery line), and 11.0.0.0 through 11.0.0.2.
- Fixed: 11.0.0.3 for the 10.6 continuous delivery line and for 11.0.0.0 through 11.0.0.2, 10.6.0.11 for the 10.6.0 line, and 10.5.0.23 for the 10.5.0 line.
- Bulletin: IBM's security bulletin of 28 September 2026 covers several DataPower CVEs at once and lists a known issue, DT499224. It lists no workarounds.
- Severity: 6.5 with the record's CWE-416 (use after free). Not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
Check the firmware version on each appliance or virtual instance. In the DataPower command line, run:
show version
The web management interface shows the same information on its status pages. Compare the result with the ranges above. Include development, test and disaster recovery instances, which tend to lag production.
Also list which interfaces the gateway exposes and to whom. A gateway on the edge of your network is the whole point of the product, so assume the services it publishes are reachable from outside, and ask which of them handle traffic that an unauthenticated client can send.
What to do now
- List every DataPower Gateway with its version and where it sits in your network.
- Upgrade to the fixed release for your line: 11.0.0.3, 10.6.0.11 or 10.5.0.23.
- Read the bulletin's known issue note, DT499224, before the upgrade so the change plan covers it.
- Plan for the same maintenance window to cover all the DataPower CVEs in the bulletin, not just this one.
- Review gateway logs for crashes or restarts around the time before the upgrade.
Why it matters
A use after free (CWE-416) means the program frees a block of memory and then keeps using it. By then the block may hold something else, so the program may read data it should not see, or crash. IBM describes both results: a denial of service, and exposure of sensitive information.
The score is lower than for the heap overflow in the same bulletin because the described impact is limited to availability and disclosure, not code execution. On a gateway that handles other people's traffic, those still matter. A crash takes down a shared service, and leaked memory can contain tokens or fragments of other requests.
Fix this one in the same window as the others in the bulletin. The upgrade path is identical.
Quick check
Is this the same fix as the other DataPower CVEs?
IBM's single bulletin lists one set of fixed releases for the CVEs it covers: 10.5.0.23, 10.6.0.11 and 11.0.0.3.
Does it allow code execution?
IBM describes denial of service and information disclosure for this CVE. A separate CVE in the same bulletin covers code execution.
Sources
Last reviewed: 19 October 2026.
