The vulnerability exists in IBM Sterling Partner Engagement Manager versions 6.2.3.0–6.2.3.5 and 6.2.4.0–6.2.4.2. A remote attacker can capture traffic between the client and the manager over an unencrypted channel, allowing access to sensitive data transmitted in cleartext. This flaw falls under CWE‑319 (Cleartext Transmission of Sensitive Information). The main consequence is a confidentiality breach; there is no evidence of denial of service or code execution. The attack requires the attacker to be positioned on the network path where the traffic can be observed.

Affected products are IBM Sterling Partner Engagement Manager Essentials Edition and Standard Edition. The vulnerable versions are 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 for both editions. Users should refer to the IBM support link for detailed component tables and download instructions for the patched releases 6.2.3.6 and 6.2.4.3.

The CVSS base score is 3.7, indicating a low to moderate severity. EPSS score is less than 1 %, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation is straightforward once an attacker can sniff the network; it does not require authentication or privileged access. The primary mitigation is to encrypt or protect the communication channel, such as by using TLS, or to apply the vendor patch.