CVE-2026-14999
IBM DataPower Gateway Improper Verification of Cryptographic Signature
Published Oct 8, 2026 · updated Oct 14, 2026 · IBM DataPower Gateway 10.6CD
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 8, 2026 · NIST NVD
Detected
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.
Oct 14, 2026 · NIST NVD
Updated
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.
Affected
- cpe ibm/datapower gatewayversion unspecified
- vendor IBM DataPower Gateway 10.5.0version unspecified
- vendor IBM DataPower Gateway 10.6.0version unspecified
- vendor IBM DataPower Gateway 10.6CDversion unspecified
- vendor IBM DataPower Gateway 11.0.0version unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-14999
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-14999
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-14999
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2026-14999
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.
nvd.nist.gov