IBM Datapower Gateway 10.6.0 vulnerabilities

2 CVEs affecting IBM Datapower Gateway 10.6.0, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-14990, published 2026-10-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-36374, published 2026-07-30. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or…
CVE-2026-14990, published 2026-10-08. Critical severity, CVSS 9.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus…