What is the CVSS score of EUVD-2026-47768?

EUVD-2026-47768 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for EUVD-2026-47768?

Yes, a patch is available for EUVD-2026-47768. Update the affected software to the latest version immediately.

Sterling B2B Integrator EUVD-2026-47768

| CVE-2026-3482 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-22 ibm

Authentication Bypass IBM Sterling B2b Integrator Sterling File Gateway

5.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated HTTP bypass with read-only confidentiality impact; no integrity or availability consequence confirmed by description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:08 vuln.today

DescriptionCVE.org

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 could allow an unauthenticated user to read sensitive information by bypassing authentication through a specially crafted HTTP request.

AnalysisAI

Unauthenticated information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway allows remote attackers to read sensitive data by sending a specially crafted HTTP request that bypasses authentication controls. Affected deployments span versions 6.2.0.0 through 6.2.2.0_1 across both products, covering a wide span of the 6.2.x release train. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch and published an advisory.

Technical ContextAI

IBM Sterling B2B Integrator and Sterling File Gateway are Java-based enterprise middleware platforms used for EDI, supply chain, and B2B file transfer orchestration. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a class of flaw where an attacker manipulates a user-supplied key or identifier within an HTTP request to circumvent server-side authentication or authorization checks - effectively an insecure direct object reference or parameter tampering pattern applied at the authentication layer. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the vulnerable interface is network-accessible and requires no prior authentication, consistent with an unauthenticated HTTP endpoint that improperly trusts a caller-supplied token or record key. Affected CPEs are cpe:2.3:a:ibm:sterling_b2b_integrator and cpe:2.3:a:ibm:sterling_file_gateway, both across the 6.2.x branch.

RemediationAI

Apply the IBM-released patch as documented in the vendor advisory at https://www.ibm.com/support/pages/node/7280657. The input data confirms a patch is available from IBM but does not specify the exact fixed version number - consult the advisory directly to obtain the correct target release for your branch (6.2.0.x, 6.2.1.x, or 6.2.2.x). If immediate patching is not feasible, implement network-level access controls to restrict HTTP access to Sterling B2B Integrator and Sterling File Gateway management and API interfaces to trusted internal hosts or VPN-connected clients only, using firewall rules or a WAF with IP allowlisting; note this trades operational accessibility for reduced attack surface and does not eliminate the underlying flaw. Additionally, review application access logs for anomalous unauthenticated requests to data-bearing endpoints as a detection measure.