IBM DataPower Gateway CVE-2026-14990

Exploitation targets the DataPower Gateway Web UI (the appliance management console) and requires an authenticated operator/administrator to interact with attacker-supplied content (CVSS UI:R) - e.g. clicking a crafted link or loading a malicious request against the UI; the attacker themselves needs no credentials (PR:N). The meaningful impact (credential/session disclosure) is realized only within a trusted, already-authenticated UI session, so the limiting factors are: (1) the victim must be a logged-in Web UI user, (2) the management interface must be reachable by the attacker's lure path, and (3) user interaction is mandatory, which rules out silent mass exploitation. Affected only in versions 10.6.0.0 through 10.6.0.10; upgrading to the vendor-fixed build removes exposure.

This is a genuinely high-priority issue, though not for the reasons a 9.3 headline alone implies. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) describes a network-reachable, low-complexity cross-site scripting flaw requiring no attacker privileges (PR:N, so unauthenticated) but requiring victim interaction (UI:R) - meaning a user must be lured into loading a crafted request/link against the DataPower Web UI. The scope change (S:C) and C:H/I:H reflect that script executing in an administrator's trusted session can harvest credentials or session material and act with that operator's authority, which is what drives the inflated score. Note the 9.3 figure does not match the CVSS 3.1 base computation for the supplied vector (that vector yields 9.0 under 3.1), suggesting the 9.3 is a CVSS 4.0-derived number applied to a 3.1 string - a minor data inconsistency worth noting but not changing the overall picture. Critically, there is NO EPSS score, NO CISA KEV listing, and NO public proof-of-concept provided in the input, so there is no evidence of active or imminent widespread exploitation; the risk here is theoretical-but-serious rather than confirmed-in-progress. The UI:R requirement materially lowers real-world exploitability versus a pure drive-by, because an attacker must still socially engineer an authenticated operator. Net: patch promptly given it targets the management plane of a security appliance, but this is a serious-latent-risk item, not an emergency-active-exploitation item.

An attacker crafts a malicious URL or request targeting the DataPower Gateway Web UI that injects attacker-controlled JavaScript, then lures an administrator into opening it while logged into the management console. The injected script executes in the operator's trusted session, exfiltrating session credentials or tokens that let the attacker impersonate the administrator. No public exploit code was identified at time of analysis, and successful exploitation depends on the victim interacting with the attacker-supplied content (CVSS UI:R).