CVE-2026-14269: CWE-122 Heap-based buffer overflow in IBM DataPower Gateway 10.6CD

CVE-2026-14269 is a heap-based buffer overflow vulnerability in IBM DataPower Gateway 10.6CD and related versions. The issue arises from improper bounds checking, enabling an unauthenticated remote attacker to overflow a heap buffer and execute arbitrary code remotely. The affected versions include 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. The vulnerability has a critical CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit this heap-based buffer overflow to execute arbitrary code on the affected IBM DataPower Gateway systems. This can lead to full system compromise, including unauthorized access, data disclosure, and disruption of service. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability of the system.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the affected systems and monitor for suspicious activity related to this vulnerability.