CVE-2026-14508: CWE-416 Use After Free in IBM DataPower Gateway 10.6CD

IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2 contain a use-after-free vulnerability (CWE-416). This vulnerability could be exploited remotely without privileges or user interaction to cause denial of service and disclose sensitive information. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact.

A remote attacker could exploit this use-after-free vulnerability to cause the IBM DataPower Gateway service to crash, resulting in denial of service. Additionally, the attacker may be able to access sensitive information due to improper memory handling. There is no indication of integrity compromise. The vulnerability does not require authentication or user interaction to exploit.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, monitor IBM security advisories for updates. No vendor-provided mitigation or temporary fix information is included in the provided data.