CVE-2026-0835

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0835", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-01-09T23:27:35.566Z", "datePublished": "2026-03-13T18:57:35.435Z", "dateUpdated": "2026-03-13T19:36:39.022Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-13T19:01:09.073Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "affected": [{"versions": [{"status": "affected", "version": "6.1.0.0", "lessThanOrEqual": "6.1.2.7_2", "versionType": "semver"}, {"status": "affected", "version": "6.2.0.0", "lessThanOrEqual": "6.2.0.5_1", "versionType": "semver"}, {"status": "affected", "version": "6.2.1.0", "lessThanOrEqual": "6.2.1.1_1", "versionType": "semver"}, {"status": "affected", "version": "6.2.2.0", "versionType": "semver"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.0.0:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.7_2:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.0:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.5_1:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.0:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.1_1:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.2.0:*:*:*:standard:*:*:*"], "vendor": "IBM", "product": "Sterling B2B Integrator"}], "descriptions": [{"lang": "en", "value": "IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through\u00a06.1.2.7_2,\u00a06.2.0.0 through\u00a06.2.0.5_1, 6.2.1.0 through\u00a06.2.1.1_1, and 6.2.2.0 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through&nbsp;6.1.2.7_2,&nbsp;6.2.0.0 through&nbsp;6.2.0.5_1, 6.2.1.0 through&nbsp;6.2.1.1_1, and 6.2.2.0 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7263326", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}, "solutions": [{"lang": "en", "value": "ProductVersionAPARRemediation & FixIBM Sterling B2B Integrator and IBM Sterling File Gateway6.1.0.0 - 6.1.2.7_2IT48958 \u00a0Apply B2Bi 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0_1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.0.0 - 6.2.0.5_1IT48958 \u00a0Apply B2Bi 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0_1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.1.0 - 6.2.1.1_1IT48958 \u00a0Apply B2Bi 6.2.1.1_2 or 6.2.2.0_1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.2.0IT48958\u00a0Apply B2Bi 6.2.2.0_1The IIM versions of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0_1 are available on\u00a0 Fix Central http://www-933.ibm.com/support/fixcentral/swg/selectFixes .\u00a0\n\nThe container version of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0_1 are available in IBM Entitled Registry.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<table><tbody><tr><td>Product</td><td>Version</td><td>APAR</td><td>Remediation &amp; Fix</td></tr><tr><td>IBM Sterling B2B Integrator and IBM Sterling File Gateway</td><td>6.1.0.0 - 6.1.2.7_2</td><td>IT48958 &nbsp;</td><td>Apply B2Bi 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0_1</td></tr><tr><td>IBM Sterling B2B Integrator and IBM Sterling File Gateway</td><td>6.2.0.0 - 6.2.0.5_1</td><td>IT48958 &nbsp;</td><td>Apply B2Bi 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0_1</td></tr><tr><td>IBM Sterling B2B Integrator and IBM Sterling File Gateway</td><td>6.2.1.0 - 6.2.1.1_1</td><td>IT48958 &nbsp;</td><td>Apply B2Bi 6.2.1.1_2 or 6.2.2.0_1</td></tr><tr><td>IBM Sterling B2B Integrator and IBM Sterling File Gateway</td><td>6.2.2.0</td><td>IT48958&nbsp;</td><td>Apply B2Bi 6.2.2.0_1</td></tr></tbody></table><div><p>The IIM versions of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0_1 are available on&nbsp;<a href=\"http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Other%2Bsoftware&amp;product=ibm/Other+software/Sterling+B2B+Integrator&amp;release=All&amp;platform=All&amp;function=all\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Fix Central</a>.&nbsp;</p><p>The container version of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0_1 are available in IBM Entitled Registry.</p></div>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T19:36:29.900119Z", "id": "CVE-2026-0835", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:36:39.022Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0835", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T19:36:29.900119Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:36:34.834Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.0.0:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.7_2:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.0:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.5_1:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.0:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.1_1:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.2.0:*:*:*:standard:*:*:*"], "vendor": "IBM", "product": "Sterling B2B Integrator", "versions": [{"status": "affected", "version": "6.1.0.0", "versionType": "semver", "lessThanOrEqual": "6.1.2.7_2"}, {"status": "affected", "version": "6.2.0.0", "versionType": "semver", "lessThanOrEqual": "6.2.0.5_1"}, {"status": "affected", "version": "6.2.1.0", "versionType": "semver", "lessThanOrEqual": "6.2.1.1_1"}, {"status": "affected", "version": "6.2.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "ProductVersionAPARRemediation & FixIBM Sterling B2B Integrator and IBM Sterling File Gateway6.1.0.0 - 6.1.2.7_2IT48958 \u00a0Apply B2Bi 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0_1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.0.0 - 6.2.0.5_1IT48958 \u00a0Apply B2Bi 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0_1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.1.0 - 6.2.1.1_1IT48958 \u00a0Apply B2Bi 6.2.1.1_2 or 6.2.2.0_1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.2.0IT48958\u00a0Apply B2Bi 6.2.2.0_1The IIM versions of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0_1 are available on\u00a0 Fix Central http://www-933.ibm.com/support/fixcentral/swg/selectFixes .\u00a0\n\nThe container version of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0_1 are available in IBM Entitled Registry.", "supportingMedia": [{"type": "text/html", "value": "<table><tbody><tr><td>Product</td><td>Version</td><td>APAR</td><td>Remediation &amp; Fix</td></tr><tr><td>IBM Sterling B2B Integrator and IBM Sterling File Gateway</td><td>6.1.0.0 - 6.1.2.7_2</td><td>IT48958 &nbsp;</td><td>Apply B2Bi 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0_1</td></tr><tr><td>IBM Sterling B2B Integrator and IBM Sterling File Gateway</td><td>6.2.0.0 - 6.2.0.5_1</td><td>IT48958 &nbsp;</td><td>Apply B2Bi 6.2.0.5_2, 6.2.1.1_2 or 6.2.2.0_1</td></tr><tr><td>IBM Sterling B2B Integrator and IBM Sterling File Gateway</td><td>6.2.1.0 - 6.2.1.1_1</td><td>IT48958 &nbsp;</td><td>Apply B2Bi 6.2.1.1_2 or 6.2.2.0_1</td></tr><tr><td>IBM Sterling B2B Integrator and IBM Sterling File Gateway</td><td>6.2.2.0</td><td>IT48958&nbsp;</td><td>Apply B2Bi 6.2.2.0_1</td></tr></tbody></table><div><p>The IIM versions of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0_1 are available on&nbsp;<a href=\"http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Other%2Bsoftware&amp;product=ibm/Other+software/Sterling+B2B+Integrator&amp;release=All&amp;platform=All&amp;function=all\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Fix Central</a>.&nbsp;</p><p>The container version of 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2 and 6.2.2.0_1 are available in IBM Entitled Registry.</p></div>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7263326", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through\u00a06.1.2.7_2,\u00a06.2.0.0 through\u00a06.2.0.5_1, 6.2.1.0 through\u00a06.2.1.1_1, and 6.2.2.0 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.", "supportingMedia": [{"type": "text/html", "value": "IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through&nbsp;6.1.2.7_2,&nbsp;6.2.0.0 through&nbsp;6.2.0.5_1, 6.2.1.0 through&nbsp;6.2.1.1_1, and 6.2.2.0 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-13T19:01:09.073Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0835", "state": "PUBLISHED", "dateUpdated": "2026-03-13T19:36:39.022Z", "dateReserved": "2026-01-09T23:27:35.566Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-03-13T18:57:35.435Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.0.0:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.7_2:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.0:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.5_1:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.0:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.1_1:*:*:*:standard:*:*:*", "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.2.0:*:*:*:standard:*:*:*"], "defaultStatus": "unaffected", "product": "Sterling B2B Integrator", "vendor": "IBM", "versions": [{"lessThanOrEqual": "6.1.2.7_2", "status": "affected", "version": "6.1.0.0", "versionType": "semver"}, {"lessThanOrEqual": "6.2.0.5_1", "status": "affected", "version": "6.2.0.0", "versionType": "semver"}, {"lessThanOrEqual": "6.2.1.1_1", "status": "affected", "version": "6.2.1.0", "versionType": "semver"}, {"status": "affected", "version": "6.2.2.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF5BFBAA-B7B6-43FC-893D-F62E8AC28673", "versionEndExcluding": "6.1.2.8", "versionStartIncluding": "6.1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "0F026F01-EF66-4E43-A081-F1B2C7C87904", "versionEndExcluding": "6.2.0.5_2", "versionStartIncluding": "6.2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D31014C-F7D8-4B69-AB89-2A6AEAB7B667", "versionEndExcluding": "6.2.1.1_2", "versionStartIncluding": "6.2.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "E8CC6F03-A96D-4D0F-A846-890006E405A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_file_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "00C60634-AE0C-4641-B645-0D0511A0070C", "versionEndExcluding": "6.1.2.8", "versionStartIncluding": "6.1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_file_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "98CB35E7-789A-44B3-86E3-6F2A0CE56D4F", "versionEndExcluding": "6.2.0.5_2", "versionStartIncluding": "6.2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_file_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "4AD23AED-25F6-45AB-93DD-FC1864431290", "versionEndExcluding": "6.2.1.1_2", "versionStartIncluding": "6.2.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sterling_file_gateway:6.2.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "C2813946-2022-4789-9285-25E576E49609", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through\u00a06.1.2.7_2,\u00a06.2.0.0 through\u00a06.2.0.5_1, 6.2.1.0 through\u00a06.2.1.1_1, and 6.2.2.0 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."}, {"lang": "es", "value": "IBM Sterling B2B Integrator e IBM Sterling File Gateway 6.1.0.0 hasta 6.1.2.7_2, 6.2.0.0 hasta 6.2.0.5_1, 6.2.1.0 hasta 6.2.1.1_1, y 6.2.2.0 son vulnerables a cross-site scripting. Esta vulnerabilidad permite a un usuario autenticado incrustar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista, potencialmente llevando a la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n de confianza."}], "id": "CVE-2026-0835", "lastModified": "2026-06-17T10:11:28.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0835", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T19:36:29.900119Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:53:56.827", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7263326"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.1.0.0,6.1.2.7_2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.2.0.0,6.2.0.5_1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.2.1.0,6.2.1.1_1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.2.2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Sterling B2B Integrator", "source": "cna", "vendor": "IBM"}, "product": "sterling_b2b_integrator", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-04-16T02:45:53.994367+00:00", "value": {"mitigation_remediation": ["Apply a recent patch or upgrade to IBM Sterling B2B Integrator or IBM Sterling File Gateway version 6.1.2.8, 6.2.0.5_2, 6.2.1.1_2, or 6.2.2.0_1 from Fix Central or the Entitled Registry.", "If an immediate patch is not feasible, restrict access to the Web UI by limiting it to trusted network segments and enforce least\u2011privilege authentication for all users.", "Deploy additional input validation or a web application firewall that blocks script injection in the UI to mitigate the effect of the CWE\u201179 weakness until a patch is applied.", "Monitor audit logs for anomalous script injection activity to detect potential exploitation attempts."], "summary": {"action": "Patch Immediately", "impact": "Cross\u2011Site Scripting that may expose credentials within trusted sessions"}, "threat_synthesis": {"affected_systems": "IBM Sterling B2B Integrator and IBM Sterling File Gateway are affected. The vulnerable versions span from 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0. These range include both standard enterprise releases and file gateway components as reflected in the listed CPE identifiers.", "description_and_impact": "This vulnerability, identified as a cross\u2011site scripting flaw, permits an authenticated user to inject arbitrary JavaScript into the Web UI. The injected code can alter the intended functionality of the portal and potentially exfiltrate session credentials or other sensitive data. The weakness is classified under CWE\u201179, highlighting a failure of proper input validation and output encoding.", "risk_and_exploitability": "The CVSS score of 5.4 indicates a moderate severity. Exploitation probability, as per EPSS, is less than 1%, suggesting a low likelihood but not impossible, and the vulnerability is not currently catalogued in the KEV list. The attack vector is inferred to originate from within the authenticated Web UI; an attacker must first obtain valid credentials or leverage a compromised account. Once access is achieved, the flaw can be exploited without additional privileges, making the risk significant for organizations that have not timely applied the recommended patches."}}}}, "created": "2026-03-16T09:24:33.355056+00:00", "title": "Cross\u2011Site Scripting in IBM Sterling B2B Integrator and File Gateway Exposing Credentials", "updated": "2026-04-16T03:00:09.177129+00:00", "vendors": ["ibm", "ibm$PRODUCT$sterling_b2b_integrator"]}