CVE-2026-14497: CWE-347 Improper Verification of Cryptographic Signature in IBM DataPower Gateway 10.6CD

IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2 contain a vulnerability classified as CWE-347 (Improper Verification of Cryptographic Signature). This flaw allows a remote attacker with authentication privileges to bypass security restrictions by exploiting improper cryptographic signature verification. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, low attack complexity, and no user interaction required. The impact affects confidentiality and integrity but not availability. No known exploits in the wild have been reported. No patch or remediation information is provided in the source data.

A remote authenticated attacker could bypass security restrictions due to improper verification of cryptographic signatures. This could lead to unauthorized access or actions that compromise confidentiality and integrity of the system. Availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's security advisories for updates. Until a fix is available, restrict access to trusted users and consider additional compensating controls for cryptographic operations if feasible.