EUVD-2026-78146
GHSA-8f75-86xx-87vh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Vendor vector is credible: network-reachable auth bypass requiring a valid low-privilege account (PR:L), low complexity, limited C/I impact and no availability impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
1DescriptionCVE.org
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 Standard Edition could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
AnalysisAI
IBM Sterling B2B Integrator (6.2.0.0 through 6.2.0.6_2, 6.2.1.0-6.2.1.2, 6.2.2.0-6.2.2.1) and IBM Sterling File Gateway Standard Edition in the same version ranges contain an improper authentication flaw (CWE-287) that lets a remote authenticated attacker bypass security restrictions. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), indicating a low-privilege authenticated network attacker can gain limited read and modify capability without user interaction, but no confidentiality-integrity-availability loss beyond partial. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a remote authenticated session - the CVSS vector specifies AV:N/AC:L/PR:L/UI:N, so the attacker must already possess valid low-privileged credentials for IBM Sterling B2B Integrator or Sterling File Gateway (a partner account, operations user, or any authenticated non-admin identity). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are moderate and internally consistent: CVSS 3.1 scores 5.4 with an attack path of network vector, low complexity, low privileges, no user interaction, and limited (partial) confidentiality and integrity impact with no availability impact - a classic authenticated privilege/authorization bypass rather than a pre-auth remote code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has published a vendor advisory for this issue at https://www.ibm.com/support/pages/node/7287190; apply the fixed build identified there for each affected release train (the input data does not specify the exact patched version, so confirm the target fix level with IBM before upgrading rather than assuming). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today