IBM Sterling Connect:Direct CVE-2026-105453

Exploitation requires the attacker to already have local access to the UNIX host and a valid low-privileged account (CVSS PR:L), consistent with AV:L - this is not remotely reachable. The flaw is improper privilege management within IBM Sterling Connect:Direct for UNIX, so the host must be running an affected version (6.3.0.0 through 6.3.0.7 or 6.4.0.0 through 6.4.0.6) with the Connect:Direct for UNIX daemon/components installed and running under elevated (e.g., root) privileges. No user interaction is needed (UI:N) and complexity is low (AC:L). The primary limiting factors are the prerequisite local foothold and low-privilege credentials; hosts where only trusted administrators have shell access present a much smaller realistic attack surface. The specific binary, setuid component, or configuration that mishandles privileges is not named in the available description - verify against the IBM advisory.

This is a local privilege-escalation flaw (CWE-269, improper privilege management) in IBM Sterling Connect:Direct for UNIX. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base 8.4) is internally consistent and credible: a local, already-authenticated low-privileged user can escalate with low attack complexity and no user interaction, and the scope change (S:C) plus C:H/I:H reflect a jump from the application's low-privilege context to high-impact control over the host (typically root/daemon identity). The high base score is driven largely by the scope change and dual confidentiality/integrity impact, NOT by remote reachability - AV:L means the attacker must first have local access and valid low-privilege credentials, which materially limits the realistic attack surface compared with a network-facing bug. Key exploitation signals are MISSING: no EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active or at-scale exploitation; per precision rules this is 'no public exploit identified at time of analysis.' There is no SSVC data supplied. Net: treat this as a solid patch priority on hosts where untrusted or semi-trusted local users have shell access (shared MFT servers, multi-tenant UNIX hosts), but it is a privilege-escalation issue requiring a prior foothold rather than an internet-exploitable emergency; absent EPSS/KEV/POC it does not rise to drop-everything urgency on well-segregated, single-admin systems.

An attacker who already has a low-privileged local shell on a UNIX host running Sterling Connect:Direct (e.g., a limited service or operator account) abuses the product's improper privilege management to execute code or access files as the high-privileged Connect:Direct identity (typically root). This yields full read/modify control of the host and the sensitive files Connect:Direct transfers. No public exploit code was identified at time of analysis, and the attack requires no user interaction once local access is obtained.