IBM Datapower Gateway vulnerabilities

81 CVEs affecting IBM Datapower Gateway, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-14999, published 2026-10-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1663, published 2018-12-07. Medium severity, CVSS 5.9. EPSS: 2.3% chance of exploitation in the next 30 days. IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An…
CVE-2020-4579, published 2020-09-21. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted HTTP/2 request with invalid characters. IBM X-Force ID:…
CVE-2018-1669, published 2018-09-25. High severity, CVSS 7.1. EPSS: 1.9% chance of exploitation in the next 30 days. IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2…
CVE-2019-4621, published 2019-12-09. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use…
CVE-2020-4581, published 2020-09-21. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a chunked transfer-encoding HTTP/2 request. IBM X-Force ID: 184441.
CVE-2020-4580, published 2020-09-21. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted a JSON request with invalid characters. IBM X-Force ID:…
CVE-2021-38872, published 2022-05-17. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a denial of service by consuming resources with multiple…
CVE-2020-4994, published 2022-05-17. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a temporary denial of service by sending invalid HTTP requests. IBM X-Force ID:…
CVE-2018-1668, published 2019-01-29. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM DataPower Gateway 7.5.0.0 through 7.5.0.19, 7.5.1.0 through 7.5.1.18, 7.5.2.0 through 7.5.2.18, and 7.6.0.0 through 7.6.0.11 appliances allows "null" logins which could give read access to IPMI…
CVE-2018-1421, published 2018-04-04. High severity, CVSS 7.1. EPSS: 1.4% chance of exploitation in the next 30 days. IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this…

Latest

CVE-2026-14999, published 2026-10-08. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging…
CVE-2026-14992, published 2026-10-08. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.
CVE-2026-14988, published 2026-10-08. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.
CVE-2026-14905, published 2026-10-08. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when…
CVE-2026-14888, published 2026-10-08. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a…
CVE-2026-14509, published 2026-10-08. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to…
CVE-2026-14508, published 2026-10-08. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and…
CVE-2026-14507, published 2026-10-08. High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation.
CVE-2026-14502, published 2026-10-08. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to…
CVE-2026-14497, published 2026-10-08. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security…