Advisory · CVE-2026-14905
XXE in IBM DataPower Gateway XML processing
IBM DataPower Gateway can be tricked into reading attacker-defined external entities when processing XML data, exposing files or draining memory.
- Vendor
- IBM
- Product
- DataPower Gateway
- Identifier / CWE
- CVE-2026-14905
CWE-611 - Action timing
- Immediate
Explain it like I’m five
You hand the appliance a letter that says read the file taped to the back of this envelope. It obediently reads it out loud and mails you the contents.
- 01Crafted XML
A remote attacker submits XML containing external entity definitions.
- 02Entity resolved
The gateway resolves the entities while processing the document.
- 03Disclosure or drain
File contents are exposed in the response, or memory is consumed until the service degrades.
What happened
IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 are vulnerable to XML external entity injection when processing XML data, according to the IBM security bulletin. A remote attacker can expose sensitive information or consume memory resources. IBM rates it high at CVSS 8.2.
What to do
- Identify DataPower Gateway appliances and confirm the running firmware version against the affected ranges.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Restrict XML processing endpoints to trusted senders until patched.
- Review logs for unusual XML payloads or unexplained memory pressure.
Management note
XXE is an old weakness with a stubborn habit of reappearing in enterprise XML pipelines. On a gateway that exists to inspect other people’s XML, it is worth the patch window.