What is the CVSS score of CVE-2026-3482?

CVE-2026-3482 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2026-3482?

Yes, a patch is available for CVE-2026-3482. Update the affected software to the latest version immediately.

Sterling B2B Integrator CVE-2026-3482

EUVD-2026-47768 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-22 ibm

IBM Authentication Bypass Sterling B2b Integrator Sterling File Gateway

5.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated HTTP bypass with read-only confidentiality impact; no integrity or availability consequence confirmed by description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:08 vuln.today

DescriptionCVE.org

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 could allow an unauthenticated user to read sensitive information by bypassing authentication through a specially crafted HTTP request.

AnalysisAI

Unauthenticated information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway allows remote attackers to read sensitive data by sending a specially crafted HTTP request that bypasses authentication controls. Affected deployments span versions 6.2.0.0 through 6.2.2.0_1 across both products, covering a wide span of the 6.2.x release train. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify network-accessible Sterling B2B Integrator HTTP endpoint

Delivery

Enumerate API parameters or intercept traffic to identify user-controlled key

Exploit

Craft HTTP request with manipulated key bypassing authentication

Execution

Server returns sensitive B2B or file transfer data

Impact

Attacker reads protected information

Access

Identify network-accessible Sterling B2B Integrator HTTP endpoint

Delivery

Enumerate API parameters or intercept traffic to identify user-controlled key

Exploit

Craft HTTP request with manipulated key bypassing authentication

Execution

Server returns sensitive B2B or file transfer data

Impact

Attacker reads protected information

Vulnerability AssessmentAI

Exploitation	No special configuration is required beyond network reachability of the IBM Sterling B2B Integrator or Sterling File Gateway HTTP interface - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against network-accessible instances. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS base score of 5.3 (Medium) reflects a network-reachable, zero-complexity, unauthenticated attack path - all high-severity preconditions - but limited to low confidentiality impact (C:L) with no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A remote, unauthenticated attacker with network access to an exposed Sterling B2B Integrator web interface sends a specially crafted HTTP request containing a manipulated key or identifier parameter, causing the server to bypass its authentication check and return sensitive B2B data - such as trading partner configuration, transaction records, or file transfer metadata - without requiring valid credentials. No public exploit exists at time of analysis, but the low attack complexity (AC:L) and CWE-639 pattern suggest the technique is discoverable through HTTP traffic analysis or API enumeration.
Remediation	Apply the IBM-released patch as documented in the vendor advisory at https://www.ibm.com/support/pages/node/7280657. … Detailed patch versions, workarounds, and compensating controls in full report.