Skip to main content

IBM Sterling File Gateway CVE-2026-19290

| EUVDEUVD-2026-78141 HIGH
Improper Access Control (CWE-284)
2026-09-14 ibm GHSA-94f8-33jr-325g
Authentication Bypass IBM Sterling File Gateway
7.5
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
7.5 HIGH

Unauthenticated remote read of sensitive files per the advisory, so PR:N and AV:N; no integrity or availability impact, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Sep 15, 2026 - 10:38 vuln.today
CVE Published
Sep 14, 2026 - 20:57 nvd
HIGH 7.5

DescriptionCVE.org

IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.

AnalysisAI

Improper access control in IBM Sterling File Gateway (6.2.0.0 through 6.2.0.6_1, 6.2.1.0-6.2.1.2, and 6.2.2.0-6.2.2.1) lets a remote, unauthenticated attacker reach file-transfer data they should not be able to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H) describes a trivially reachable, no-credentials-required read of sensitive information with no integrity or availability impact. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The prerequisite is that the vulnerable access-control path is reachable from the attacker's position - in practice, a Sterling File Gateway deployment whose web/partner interface is exposed beyond a trusted network, which is the normal configuration for MFT hubs accepting external trading partners. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals point to a genuine but situational priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation IBM has released a vendor fix; apply the corrected Sterling File Gateway fix pack identified in the IBM support page https://www.ibm.com/support/pages/node/7287180 for your 6.2.0.x, 6.2.1.x, or 6.2.2.x line, and treat any 6.2.0.6_1, 6.2.1.2, or 6.2.2.1 build as vulnerable until upgraded. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Sterling File Gateway

View all
CVE-2012-5937 CRITICAL
9.3 Apr 12

Unspecified vulnerability in the CLA2 server in IBM Gentran Integration Suite 4.3, Sterling Integrator 5.0 and 5.1, and

CVE-2018-1563 MEDIUM POC
5.4 Jul 20

IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) is vulnerable to cross-site
CVE-2021-20489 HIGH
8.8 Oct 07

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attac
CVE-2020-4647 HIGH
8.8 Nov 16

IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 is vulnerable to SQL injection. Rated high
CVE-2013-4002 HIGH
7.1 Jul 23

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5
CVE-2026-7769 HIGH
8.1 Jul 28

SQL injection in IBM Sterling B2B Integrator and File Gateway allows authenticated remote attackers to view, add, modify
CVE-2020-4476 HIGH
7.5 Nov 16

IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain se
CVE-2019-4147 HIGH
7.2 Sep 16

IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. Rated high severity (CVSS 7.2), this v
CVE-2013-2984 MEDIUM
6.5 Jul 03

Directory traversal vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow
CVE-2013-2982 MEDIUM
6.5 Jul 03

IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to upload
CVE-2013-5409 MEDIUM
6.5 Dec 21

Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote aut
CVE-2012-5766 MEDIUM
6.5 Jul 03

Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-19290 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy