Sterling B2B Integrator CVE-2025-36002

Exploitation requires local access to the server hosting IBM Sterling B2B Integrator or Sterling File Gateway AND a low-privileged authenticated account on that host (CVSS PR:L), with read permission to the application's configuration files where credentials are stored in cleartext or recoverable form. Limiting factors that reduce realistic risk: no remote network vector (AV:L means an attacker must already be on the box), no user interaction can substitute for local access, and impact is confined to confidentiality (disclosure of the stored credentials) - there is no direct integrity or availability effect. The flaw is a property of the affected product versions themselves rather than an optional feature toggle, so it applies to standard deployments of the listed versions.

This is a low-to-moderate priority information-disclosure flaw (CWE-260, Credentials in Configuration File), not an urgent patch-now issue. The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) tells a consistent story: exploitation requires LOCAL access (AV:L) and an already-authenticated low-privileged account (PR:L), with no integrity or availability impact and a high confidentiality impact limited to the disclosed credentials. All signals align and reinforce a modest risk picture: EPSS is very low at 0.15% (4th percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept is identified. There is no conflict between the CVSS vector and the description - both clearly describe a local user reading credentials from configuration files, so the local attack vector is corroborated rather than contradicted. The main caveat is that the real danger is secondary: the disclosed credentials could be reused for lateral movement or privilege escalation (a credential-theft stepping stone), but that downstream impact is not reflected in this CVE's scope-unchanged (S:U) scoring. No SSVC decision data was provided in the input, so automatable/technical-impact framing could not be cross-referenced.

A low-privileged local user on the host running IBM Sterling B2B Integrator or Sterling File Gateway (e.g. an operator, a shared service account, or an attacker who already gained a foothold) reads configuration files on disk and recovers stored user credentials. Those harvested credentials are then reused to authenticate as a higher-privileged user or to pivot to connected B2B trading-partner systems. No public exploit code is required - this is simple file reading, so no sophisticated tooling is involved.