Description
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Published: 2026-07-28
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

IBM Sterling B2B Integrator and IBM Sterling File Gateway are affected by a stored cross‑site scripting vulnerability. A privileged user can embed arbitrary JavaScript code into the Web UI, which may alter the intended functionality of the application. This flaw can lead to credential disclosure within a trusted session.

Affected Systems

IBM’s Sterling B2B Integrator and Sterling File Gateway products are impacted. Affected releases span from version 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 for both product lines.

Risk and Exploitability

The CVSS base score of 5.5 indicates a moderate severity, while the EPSS score of less than 1% signals a low exploitation probability. Because the flaw requires privileged access to the Web UI, successful exploitation is limited to users with administrator or similar rights. The vulnerability is not documented in the CISA KEV catalog, suggesting it has not been widely exploited yet.

Generated by OpenCVE AI on August 3, 2026 at 14:49 UTC.

Remediation

Vendor Solution

ProductVersionAPARRemediation & FixIBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.0.0 - 6.2.0.6IT49357 Apply B2Bi 6.2.0.6_1, 6.2.1.2, 6.2.2.1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.1.0 - 6.2.1.1_2 IT49357     Apply B2Bi 6.2.1.2, 6.2.2.1IBM Sterling B2B Integrator and IBM Sterling File Gateway6.2.2.0 - 6.2.2.0_1   IT49357    Apply B2Bi 6.2.2.1 The IIM versions of 6.2.0.6_1, 6.2.1.2 and 6.2.2.1 are available on  Fix Central http://www-933.ibm.com/support/fixcentral/swg/selectFixes .  The container version of 6.2.0.6_1, 6.2.1.2 and 6.2.2.1 are available in IBM Entitled Registry.

OpenCVE Recommended Actions

  • Apply IBM Sterling B2B Integrator and IBM Sterling File Gateway version 6.2.0.6_1, 6.2.1.2, or 6.2.2.1, the latest patches that address the stored XSS flaw.
  • For IIM releases, download and install the patch from Fix Central; for container deployments, pull the updated image from the IBM Entitled Registry.
  • Limit privileged user accounts and restrict write access to the Web UI to reduce the likelihood of an attacker injecting malicious script.

Generated by OpenCVE AI on August 3, 2026 at 14:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Title Cross-site Scripting Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway
First Time appeared Ibm
Ibm sterling B2b Integrator
Ibm sterling File Gateway
Weaknesses CWE-79
CPEs cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.1_2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.2.0_1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_file_gateway:6.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_file_gateway:6.2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_file_gateway:6.2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_file_gateway:6.2.1.1_2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_file_gateway:6.2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_file_gateway:6.2.2.0_1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm sterling B2b Integrator
Ibm sterling File Gateway
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Ibm Sterling B2b Integrator Sterling File Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-07-28T16:37:48.520Z

Reserved: 2026-05-04T15:09:09.036Z

Link: CVE-2026-7775

cve-icon Vulnrichment

Updated: 2026-07-28T16:37:15.938Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-28T16:20:21.637

Modified: 2026-08-05T15:47:24.270

Link: CVE-2026-7775

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T15:00:15Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')