IBM DataPower Gateway CVE-2026-14509

Exploitation requires network reachability to a DataPower Gateway request-processing endpoint and the ability to submit input that forces worst-case linked-list traversal (CWE-400 algorithmic complexity); no authentication (PR:N) and no user interaction (UI:N) are required against affected versions 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2. The primary limiting factor is the CVSS AC:H rating: the attacker must specifically craft input to hit the pathological code path rather than trigger it with arbitrary traffic, and impact is confined to availability (service degradation/denial) with no confidentiality or integrity effect. The description does not name a specific feature toggle or non-default configuration as a prerequisite, so applicability should be assumed across affected versions until IBM advisory 7289775 states otherwise.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) shows a network-reachable, unauthenticated flaw with impact limited solely to availability - there is no confidentiality or integrity exposure. The defining mitigating signal is AC:H: the algorithmic-complexity (CWE-400) weakness in linked-list traversal requires an attacker to craft input that forces worst-case processing, so exploitation is not trivially reliable. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The CVE is NOT on the CISA KEV list and no public POC is referenced, so this is no public exploit identified at time of analysis - the risk is theoretical/potential rather than demonstrated. SSVC-style reading: exploitation status = none observed, technical impact = partial (availability only, no code execution or data loss), automatability is plausible for a DoS flood but tempered by AC:H. Net: a real availability risk worth patching for internet-facing gateways, but not a drop-everything priority absent evidence of active exploitation. Note the one conflict to verify: AC:H implies non-trivial triggering conditions, yet the description gives no specific precondition, so the practical ease of triggering the worst-case path should be confirmed with IBM.

A remote, unauthenticated attacker sends specially crafted requests to an internet-facing IBM DataPower Gateway designed to force pathological worst-case traversal of an internal linked list, driving CPU/processing time up disproportionately to input size. Repeated or sustained crafted requests exhaust processing resources and degrade or deny service to legitimate API/integration traffic. No public exploit code is identified at time of analysis, and the CVSS AC:H rating indicates the attacker must shape input carefully to reliably trigger the condition.