CVE-2026-14990: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in IBM DataPower Gateway 10.6.0

CVE-2026-14990 is a CWE-79 cross-site scripting vulnerability in IBM DataPower Gateway 10.6.0.0 through 10.6.0.10. It permits unauthenticated attackers to embed arbitrary JavaScript code in the web UI, which can manipulate the interface and may result in the disclosure of credentials during a trusted session. The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no availability impact.

An unauthenticated attacker can inject malicious scripts into the web interface, potentially compromising user credentials within an active session. This could lead to unauthorized access or control over the affected system's web management interface.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict access to the web UI and monitor for suspicious activity.