IBM CVE-2026-0835

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) indicates network-accessible attack surface, low attack complexity, and low privilege requirements (authenticated user), with user interaction needed to trigger the payload and scope change potential (affecting other users). The moderate CVSS score of 5.4 somewhat understates real-world risk because: (1) authenticated attackers can persistently inject payloads affecting all users who visit poisoned pages, (2) the ability to exfiltrate credentials within a trusted session creates high business impact despite low CVSS confidentiality rating, and (3) IBM Sterling products are critical B2B integration points where compromised sessions could lead to unauthorized trading partner access or data exfiltration. The requirement for user interaction and authenticated access limits automated exploitation, but malicious insiders or attackers with compromised credentials represent a credible threat. Without EPSS data or KEV confirmation, this should be treated as a moderate-to-high priority for organizations running affected Sterling versions in production B2B environments.

An authenticated user with access to the Sterling B2B Integrator Web UI discovers that a configuration form does not sanitize input fields. The attacker crafts a malicious URL or form submission containing JavaScript that logs all credentials entered into subsequent login forms or steals session cookies, then tricks other administrative users into visiting the compromised page (via email or internal messaging). When victims interact with the poisoned UI element, the JavaScript executes in their browsers with their trusted session context, allowing the attacker to harvest credentials or impersonate them for B2B transaction fraud.