What is the CVSS score of CVE-2026-1264?

CVE-2026-1264 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Sterling B2b Integrator are affected by CVE-2026-1264?

IBM Sterling B2B Integrator and File Gateway installations are vulnerable to unauthorized access allowing attackers to view, delete partner relationships, and remove entire communities without…. A patch is available.

How to fix or mitigate CVE-2026-1264?

Within 24 hours: Identify all Sterling B2B Integrator and File Gateway instances in your environment and document current versions. Within 7 days: Apply available patches to all affected versions (6.1.0.0-6.1.2.7_2, 6.2.0.0-6.2.0.5_1, 6.2.1.0-6.2.1.1_1, 6.2.2.0). Within 30 days: Conduct post-patch validation, audit community and partner configurations for unauthorized deletions, and implement network segmentation if patching is delayed.

Sterling B2b Integrator CVE-2026-1264

EUVD-2026-12661 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-17 ibm

IBM Authentication Bypass Sterling B2b Integrator

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 17, 2026 - 23:02 euvd

EUVD-2026-12661

Analysis Generated

Mar 17, 2026 - 23:02 vuln.today

Patch released

Mar 17, 2026 - 23:02 nvd

Patch available

CVE Published

Mar 17, 2026 - 22:41 nvd

HIGH 7.1

DescriptionCVE.org

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 allows a remote unauthenticated attacker to view and delete the partners of a community and to delete the communities.

AnalysisAI

IBM Sterling B2B Integrator and IBM Sterling File Gateway contain an authentication bypass vulnerability that allows remote unauthenticated attackers to view and delete business partners within communities, as well as delete entire communities. Multiple versions are affected including 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0. While the CVSS score is 7.1 (High), the vulnerability requires low attack complexity and no user interaction, making it straightforward to exploit over the network with low privileges.

Technical ContextAI

This vulnerability affects IBM Sterling B2B Integrator and Sterling File Gateway (CPE: cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:*:*:*:*), enterprise-grade solutions for secure file transfer and B2B transaction processing. The root cause is CWE-306 (Missing Authentication for Critical Function), meaning certain administrative or management functions that control community partner relationships lack proper authentication checks. Sterling B2B Integrator is used by enterprises to orchestrate complex supply chain transactions and electronic data interchange (EDI), making partner and community management critical security boundaries. The CVSS vector indicates Low Privileges Required (PR:L), which contradicts the description stating 'unauthenticated attacker' - this discrepancy suggests the vulnerability may allow privilege escalation from minimal authenticated access to perform administrative functions without proper authorization checks.

RemediationAI

Apply the security patches provided by IBM immediately by consulting the vendor advisory at https://www.ibm.com/support/pages/node/7266518 for specific patch versions corresponding to each affected version range. Organizations should upgrade to the patched versions as specified in the IBM support page, which will address the missing authentication checks for community and partner management functions. As an interim mitigation until patching is completed, implement network segmentation to restrict access to Sterling B2B Integrator and File Gateway management interfaces to authorized administrator IP addresses only, enforce multi-factor authentication for all user accounts, and enable comprehensive audit logging to detect any unauthorized attempts to view or delete partner or community configurations. Monitor logs for suspicious activity targeting community management endpoints and review existing partner and community configurations to ensure integrity has not been compromised.