What is the CVSS score of CVE-2026-7769?

CVE-2026-7769 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-7769?

Yes, a patch is available for CVE-2026-7769. Update the affected software to the latest version immediately.

IBM Sterling B2B Integrator CVE-2026-7769

EUVD-2026-49946 HIGH

SQL Injection (CWE-89)

2026-07-28 ibm

GHSA-pqr9-rr9q-29vr

SQLi IBM Sterling B2b Integrator Sterling File Gateway

8.1

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-accessible, low-complexity attack with low privileges and high data compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 18:50 vuln.today

CVE Published

Jul 28, 2026 - 17:58 cve.org

HIGH 8.1

DescriptionCVE.org

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

AnalysisAI

SQL injection in IBM Sterling B2B Integrator and File Gateway allows authenticated remote attackers to view, add, modify, or delete database contents. Affects versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation (KEV) known at time of analysis.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) arising from insufficient sanitization of user-supplied input that is used in SQL queries. IBM Sterling B2B Integrator and File Gateway likely rely on a relational database for configuration, transaction metadata, or operational data, and the injection point resides in an authenticated API or web interface. The CPE data confirms the affected product family is the Sterling B2B Integrator and File Gateway software suite. Attackers can manipulate SQL logic to bypass authorization checks or modify queries, leading to data disclosure or tampering.

RemediationAI

Apply the vendor-released patch as per IBM advisory https://www.ibm.com/support/pages/node/7281135. Exact fixed version numbers are not detailed in the provided data; consult the advisory for the specific patched build. As a temporary compensating control, restrict network access to the application to trusted users and networks, and enforce strict input validation at the web application firewall or reverse proxy level, though these measures do not eliminate the underlying SQL injection risk. Monitor for suspicious database queries during the patching window.