The vulnerability is a classic SQL injection flaw that allows a remote attacker to send specially constructed SQL statements to the affected IBM Sterling B2B Integrator or IBM Sterling File Gateway instances. By exploiting this weakness, an attacker could view, add, modify, or delete records in the back‑end database, compromising the confidentiality, integrity, or availability of the data the application manages. The weakness is coded as CWE‑89. The impact is limited to the scope of the authenticated application context, but the potential to alter or expose mission critical business data makes it a high‑risk finding.

IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1, as well as IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1.

The CVSS score of 8.1 classifies this flaw as high severity, though the EPSS score is below 1 percent, indicating a low predicted exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker would need remote access to the application interface where the injection point exists, but no additional prerequisites are disclosed. Once reached, the flaw can be exploited without additional privilege escalation.