IBM Sterling File Gateway CVE-2026-19290

The prerequisite is that the vulnerable access-control path is reachable from the attacker's position - in practice, a Sterling File Gateway deployment whose web/partner interface is exposed beyond a trusted network, which is the normal configuration for MFT hubs accepting external trading partners. The CVSS vector confirms no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L), so an attacker does not need a valid account, a partner certificate, or an operator to click anything. Limiting factors: the disclosure is read-only (I:N, A:N), so integrity and availability of transfers are not at risk; exploitation requires the specific affected fix-pack levels listed (6.2.0.0-6.2.0.6_1, 6.2.1.0-6.2.1.2, 6.2.2.0-6.2.2.1) and does not apply to corrected builds; and deployments that place the Gateway behind a VPN, IP allow-list, or an authenticating reverse proxy prevent an unauthenticated external attacker from reaching the vulnerable path even while unpatched. No public exploit code was identified, so a working payload is not currently available to commodity attackers.

The signals point to a genuine but situational priority. CVSS 7.5 with AV:N/AC:L/PR:N/UI:N means no credentials, no user interaction, and no timing tricks are needed - the only barrier is network reachability to the Gateway's exposed interface, which in most MFT deployments is internet-facing by design because trading partners must reach it. Confidentiality impact is rated High while integrity and availability are None, so the realistic damage is disclosure of partner files, routing metadata, or credentials embedded in exchanged documents - a serious data-protection event but not a service outage or tampering scenario. Against that, exploitation status is unconfirmed: there is no CISA KEV entry and no public exploit code in the supplied data, and no EPSS score was provided, so the widespread, automated scanning pressure that typically accompanies KEV/EPSS-notable flaws cannot be assumed. That combination - high severity, unproven exploitation - means even a mid-sized municipal IT team in rybnik should treat this as urgent enough to schedule out-of-band patching, but it does not warrant emergency incident response absent other indicators. Caveats: the EPSS value and any SSVC exploitation signal are missing from the input, so the exploitation-probability side of the assessment rests on the absence of KEV/POC rather than on positive intelligence; if EPSS later proves high, the priority ranking changes materially.

An attacker with network reach to the partner-facing Sterling File Gateway interface sends direct requests to file, mailbox, or listing endpoints that should require an authenticated session; because the access-control check is missing, the Gateway returns sensitive content such as transferred business documents or routing metadata. The request pattern is simple enough to be scripted, so the same technique could be swept across many hosts if it is ever published. Impact is confidentiality-only: the attacker reads data and need not disturb transfers, making detection dependent on request logging rather than on observed service disruption.