CVE-2026-14502: CWE-287 Improper Authentication in IBM DataPower Gateway 10.6CD

IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2 contain an improper authentication vulnerability (CWE-287). This occurs because the software does not properly reject empty passwords during LDAP authentication, potentially allowing a remote attacker to obtain administrative access without valid credentials. The CVSS 3.1 base score is 9.8, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact.

A remote attacker can gain administrative access to the IBM DataPower Gateway by exploiting the failure to reject empty passwords during LDAP authentication. This could lead to full compromise of the affected system, including unauthorized configuration changes, data exposure, and disruption of services.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the LDAP authentication interface and monitor for suspicious authentication attempts involving empty passwords.