Sterling B2B Integrator CVE-2026-81209

Exploitation requires an authenticated attacker already holding high-privilege access (PR:H) to the Sterling B2B Integrator or Sterling File Gateway application, plus the ability to read the application/system logs where credentials are improperly recorded (CWE-532). The flaw affects Standard Edition in versions 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1 of both products. The strongest limiting factors are the high-privilege prerequisite and the need for log read access - this is not remote-unauthenticated; without a privileged account the logged credentials are not reachable. The exact logging code path and the specific credentials exposed are not described in the available sources.

This is a moderate-severity information-disclosure issue (CVSS 4.9, CWE-532) that signals should be read as lower real-world urgency than the C:H component alone suggests. The CVSS vector (AV:N/AC:L/PR:H/UI:N) requires high privileges (PR:H), so an attacker must already hold a privileged account on the Sterling B2B Integrator or Sterling File Gateway instance before any credential exposure is reachable - this is the dominant limiting factor. There is no KEV listing and no EPSS score in the provided data, and no public exploit reference is present, so there is no evidence of active or imminent exploitation. The vuln.today decision label is 'this_month' (not act_now or emergency), which is consistent with a privileged-access-required confidentiality leak rather than a widely-weaponized flaw. The primary risk is privilege escalation/lateral movement: harvested credentials from logs could extend an already-authenticated foothold to other systems. EPSS and KEV data are both absent from the input and should be checked against current CISA/FIRST feeds before final prioritization.

A remote attacker who already holds a high-privilege account (PR:H) on an affected Sterling B2B Integrator or File Gateway instance views application log files and recovers sensitive credentials that were improperly recorded there. Those harvested credentials can then be reused to access back-end systems, partner connections, or other services, enabling lateral movement. No public exploit is identified at time of analysis, and the specific logging path and which credentials are exposed are not detailed in the available sources.