CVE-2026-14521: CWE-918 Server-Side Request Forgery (SSRF) in IBM DataPower Gateway 10.6CD

CVE-2026-14521 is a server-side request forgery (SSRF) vulnerability in IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2. This vulnerability allows an authenticated attacker to cause the system to send unauthorized requests, which may lead to network enumeration or facilitate further attacks. The CVSS v3.1 base score is 4.9, indicating medium severity, with attack vector network, high attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity but no impact on availability.

An authenticated attacker can exploit this SSRF vulnerability to make the IBM DataPower Gateway send unauthorized requests to internal or external systems. This could allow the attacker to enumerate internal network resources or assist in launching additional attacks. The confidentiality and integrity of data may be partially compromised, but availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor IBM's security advisories for updates. Until a fix is available, restrict access to the affected versions to trusted users only and consider additional network-level controls to limit potential SSRF exploitation.