CVE-2026-14273: CWE-863 Incorrect Authorization in IBM DataPower Gateway 10.6CD

IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2 contain an incorrect authorization vulnerability (CWE-863). This flaw allows a local attacker with low privileges to access sensitive information without proper authorization. The vulnerability does not affect availability or integrity but impacts confidentiality. No known exploits are reported in the wild. The CVSS 3.1 vector indicates local attack vector, low complexity, low privileges required, no user interaction, and scope changed with high confidentiality impact.

A local attacker with limited privileges can exploit this vulnerability to gain unauthorized access to sensitive information on affected IBM DataPower Gateway versions. The confidentiality of data is compromised, but integrity and availability are not impacted. There are no known active exploits in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only to mitigate risk.