IBM DataPower Gateway CVE-2026-13258

Exploitation requires an authenticated account on the IBM DataPower Gateway administrative Web UI (PR:L) with the ability to submit input that is stored or reflected back into UI pages, plus a second victim user who subsequently views the injected content (UI:R) - the payload does not self-execute. Realistic risk is limited to deployments where the management Web UI is accessible to multiple users of differing privilege levels; the impact (credential/session disclosure) is realized only when a more-privileged user renders the malicious content. Affected releases are 10.5.0.0-10.5.0.22, 10.6.1-10.6.6 (10.6CD), 10.6.0.0-10.6.0.10, and 11.0.0.0-11.0.0.2; environments on patched builds or that restrict Web UI access to a single trusted administrator are not meaningfully exposed.

This is a moderate-severity stored/reflected cross-site scripting flaw (CVSS 5.4, CWE-79) that scores as a genuine but non-urgent issue rather than an emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N shows network reach and low complexity, but two factors meaningfully constrain risk: PR:L means the attacker must already be an authenticated user of the DataPower management Web UI, and UI:R means a separate victim must interact with the injected content for the payload to fire. The scope change (S:C) and the description's mention of credentials disclosure within a trusted session are what elevate this above a trivial XSS - a low-privileged user can pivot toward higher-privileged administrators. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation or weaponization. Signals are internally consistent: CVSS network vector aligns with a web-based administrative interface, and the authenticated/user-interaction requirements match the description's 'authenticated user' language. Overall this is a legitimate patch-in-normal-cycle item for environments exposing the DataPower management UI to multiple users, not a drop-everything priority.

A low-privileged but authenticated user of the DataPower Gateway Web UI injects crafted JavaScript into a field that is later rendered to other operators. When a higher-privileged administrator views the affected page in their authenticated session, the script executes in their browser context and can exfiltrate session credentials or perform actions as that trusted user. No public proof-of-concept is referenced in the available data.