IBM DataPower Gateway CVE-2026-14521

Requires a valid authenticated session on the DataPower Gateway (PR:L) plus satisfaction of high-complexity preconditions (AC:H) - the description does not name the specific vulnerable feature, but exploitation depends on reaching a request-handling function that accepts an attacker-influenced destination. No user interaction is needed (UI:N). Realistic impact is bounded to appliances deployed where the gateway has network reachability to sensitive internal hosts; a gateway isolated from valuable internal targets yields little more than failed enumeration. Affected builds are DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2; other versions are not in scope.

This is a moderate-severity, low-priority issue rather than an emergency. The vendor-assigned CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N, base 4.9) tells a consistent story: although the attack is network-reachable (AV:N), it requires existing authentication (PR:L) and carries high attack complexity (AC:H), meaning conditions outside the attacker's control must be met. Impact is limited to low confidentiality and low integrity with no availability effect; the scope change (S:C) reflects that the SSRF can pivot requests into systems behind the gateway. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. All signals align - a genuine but low-urgency flaw whose value to an attacker is reconnaissance/pivoting rather than direct compromise. The only mild tension is that a scope-changing SSRF on an internet-facing API gateway could be more impactful than the 4.9 base score suggests if the appliance sits at a network boundary with reachable internal services; environmental context should inform prioritization.

An attacker who already holds valid (low-privileged) credentials on an IBM DataPower Gateway abuses a request-handling feature to coerce the appliance into issuing attacker-controlled requests to internal hosts. Because the gateway typically bridges external and internal network segments, the attacker uses it to enumerate otherwise-unreachable internal services and stage follow-on attacks. No public exploit code is known, and the high attack complexity means the attacker must satisfy specific preconditions to succeed.