CVE-2026-13258: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in IBM DataPower Gateway 10.6CD

CVE-2026-13258 is a CWE-79 cross-site scripting vulnerability affecting IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2. The vulnerability arises from improper neutralization of input during web page generation, allowing an authenticated user to embed arbitrary JavaScript code in the web UI. This can alter intended functionality and potentially disclose credentials within a trusted session. The CVSS 3.1 base score is 5.4, indicating medium severity with network attack vector, low attack complexity, required privileges, and user interaction.

An authenticated user can exploit this vulnerability to inject malicious JavaScript into the IBM DataPower Gateway web interface. This may lead to altered UI behavior and potential disclosure of credentials within the context of a trusted session. There is no indication of denial of service or remote code execution. No known exploits are reported in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user privileges to trusted personnel and monitor for suspicious activity related to the web UI.