CVE-2026-19307 · Other
NO FIX YET · SEE WHAT TO DO
IBM Sterling B2B Integrator and Sterling File Gateway versions 6.2.1.0 through 6.2.2.1_1 have an improper authorization flaw. A remote attacker with a valid account can open pages they should not be allowed to see.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running IBM Sterling B2B Integrator or IBM Sterling File Gateway Standard Edition in the listed 6.2.1.x and 6.2.2.x ranges. The attacker needs an authenticated account on the application. Deployments without a valid login path for untrusted users are lower risk.
Not affected if other-versions, unauthenticated-only-access
Who cares b2b-integrator, file-gateway, ibm-sterling, self-hosted
IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1, and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to access unauthorized pages due to improper authorization.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.