Sterling Partner Engagement Manager CVE-2025-13726

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a low-barrier attack with network accessibility and no authentication required, but impact is confidentiality-only with no integrity or availability damage. The 5.3 base score places this in the medium range, but real-world severity depends on what sensitive information is actually exposed in error messages—if responses leak database versions, API keys, internal IP addresses, or user enumeration data, the impact escalates significantly. Without active KEV status confirmation or publicly disclosed POC availability, this appears to be a tactical reconnaissance vector rather than an immediate critical threat. However, organizations using Sterling Partner Engagement Manager in internet-facing deployments should prioritize patching, as error-based information disclosure is a standard precursor to targeted attacks (e.g., SQL injection, authentication bypass, or supply chain compromises). The SSVC framework would likely rate this as 'Reduce' priority given the exposure model and potential for chaining with other vulnerabilities.

An attacker performs network reconnaissance by sending a series of malformed API requests to publicly accessible Sterling Partner Engagement Manager endpoints (e.g., /api/authentication, /api/partners). The application responds with detailed error messages revealing the database version (e.g., 'Oracle DB 11g'), backend server hostnames, and API framework details. The attacker uses this information to tailor a follow-up attack—for instance, crafting a SQL injection payload targeting the disclosed Oracle version, or attempting known exploits against the identified framework. No special tools or authentication are required; simple HTTP requests from any network location suffice.