CVE-2026-14999 is a high severity authentication bypass (CVSS 7.4) in IBM DataPower Gateway. Improper verification of cryptographic signatures lets a remote attacker forge valid JSON Web Signatures and bypass authentication on protected APIs. IBM's fixes are 10.5.0.23, 10.6.0.11 and 11.0.0.3.
What's affected
- IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6CD 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2.
- Fixed per IBM: 10.5.0 line to 10.5.0.23; 10.6.0 line to 10.6.0.11; 11.0.0 line to 11.0.0.3; the 10.6CD line to 11.0.0.3.
- Interim fixes and workarounds: none mentioned in the bulletin.
Severity: the record and IBM agree on 7.4 High (vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
How to check if you're exposed
Check the firmware version in the DataPower administration interface, or from the CLI banner, and match it to the lines above.
Then find which API gateway policies use JSON Web Token or JWS validation, because those are the paths where forged signatures matter. A list of the services and the identity providers they trust helps you judge the real exposure.
What to do now
- Record the DataPower firmware version on every gateway.
- Upgrade to the fixed release for your line: 10.5.0.23, 10.6.0.11, or 11.0.0.3.
- IBM lists no workaround, so schedule the change promptly.
- List the APIs that rely on JWS validation, and review gateway logs for tokens that were accepted from unexpected issuers.
Why it matters
The record classes this as CWE-347 (Improper Verification of Cryptographic Signature). A signature check that can be satisfied by a forged signature is no check at all. The advisory text says an attacker can forge valid JSON Web Signatures, so a token the gateway accepts as authentic may not come from the trusted issuer.
API gateways are the front door for many back ends, and they often hand identity claims to downstream services that trust the gateway. A bypass at that layer can affect every service behind it. The high attack complexity rating tempers the score. The record does not list the CVE as exploited, and it is not in the CISA KEV catalog.
Gateways that validate tokens should also have a second line of defense. Back end services can check the audience and issuer claims themselves, and anomaly alerts on logins from new locations can catch a forged token being used even if the gateway accepts it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a workaround available?
IBM lists none.
Which fix applies to the 10.6CD line?
IBM lists 11.0.0.3 for the 10.6CD line.
Sources
Last reviewed: 18 October 2026.
