Sterling B2B Integrator CVE-2026-19273

Exploitation requires a remote authenticated session - the CVSS vector specifies AV:N/AC:L/PR:L/UI:N, so the attacker must already possess valid low-privileged credentials for IBM Sterling B2B Integrator or Sterling File Gateway (a partner account, operations user, or any authenticated non-admin identity). The vulnerable component must be reachable over the network from the attacker's position, meaning either an internet-exposed or internally reachable Sterling web/service interface. It specifically does NOT require high privileges or administrator access, does not require user interaction, and is not restricted to a local or console-only vector. Limiting factors: unauthenticated outsiders cannot exploit this without obtaining credentials first, and the impact is bounded (partial confidentiality and integrity, no availability loss), so privilege escalation to full administrative control is not implied by the CVSS metrics. Authentication requirements are confirmed as low-privilege/authenticated from the CVSS vector (PR:L), not inferred from prose alone.

The signals here are moderate and internally consistent: CVSS 3.1 scores 5.4 with an attack path of network vector, low complexity, low privileges, no user interaction, and limited (partial) confidentiality and integrity impact with no availability impact - a classic authenticated privilege/authorization bypass rather than a pre-auth remote code execution. No EPSS probability, no CISA KEV entry, and no SSVC exploitation signal were provided, and no public proof-of-concept is referenced, so the evidence does not support active exploitation and should not be described as such. The PR:L metric confirms exploitation requires a valid low-privileged account, which materially constrains who can attack; the practical risk is therefore elevated for environments that expose Sterling management or partner interfaces broadly or that grant many low-privilege accounts, and lower for tightly segmented deployments. Note a data gap: no CVSS temporal/environmental or EPSS data was supplied, and IBM's advisory text was not included, so the presence or absence of in-the-wild exploitation is unconfirmed by the provided sources.

An attacker who already holds a valid low-privileged Sterling B2B Integrator or File Gateway account (for example a partner or operations user, or credentials obtained through phishing or reuse) sends crafted requests to an application endpoint whose authentication check can be bypassed, gaining access to resources and operations beyond their assigned role. Because the CVSS vector shows no user interaction and no special complexity, the bypass can be repeated at will over the network to read limited data and make limited unauthorized modifications. No public exploit code was identified in the available intelligence, so the attacker would need to develop or obtain a technique specific to this flaw.