CVE-2026-12737 · Vendor
NO FIX YET
IBM Sterling B2B Integrator and Sterling File Gateway 6.2.2.0 through 6.2.2.1_1 write potentially sensitive information into log files. A local user with privileged access to the host can read that information.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running IBM Sterling B2B Integrator or Sterling File Gateway in the affected 6.2.2 release range are exposed. Exposure requires a local user with privileged access to the server, so systems with tight host access controls carry less risk. The sources do not describe the specific data written to logs.
Not affected if no-local-privileged-access-risk, versions-outside-6.2.2.0-to-6.2.2.1_1
Who cares b2b-integrator, file-gateway, ibm-sterling, self-hosted
No fix yet, per the sources.
IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.1_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.1_1 stores potentially sensitive information in log files that could be read by a local privileged user.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.