VDB

CVE-2026-13258

CVE-2026-13258 PUBLISHED CVSS 5.4 MEDIUM

Reported by ibm · Published October 8, 2026

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Risk Scores

CVSS 3.1
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected Products

VendorProductVersions
IBMDataPower Gateway 10.6CD10.6.1
IBMDataPower Gateway 10.6.010.6.0.0
IBMDataPower Gateway 11.0.011.0.0.0
IBMDataPower Gateway 10.5.010.5.0.0
IBMDataPower Gateway 10.6CD10.6.1
IBMDataPower Gateway 10.5.010.5.0.0
IBMDataPower Gateway 11.0.011.0.0.0
IBMDataPower Gateway 10.6.010.6.0.0

Timeline

  • Sep 28, 2026 CVE Published
  • Oct 9, 2026 EPSS Score
  • Oct 14, 2026 EPSS Score
  • Oct 15, 2026 EPSS Score

References

  • vendor-advisorypatch
Open in Interactive Console →
$ Console Community · 100/wk Open console ›