{"id":"CVE-2026-81209","kind":"vulnerability","aliases":["CVE-2026-81209"],"related":[],"title":"IBM Sterling B2B Integrator: logs expose sensitive credentials to authenticated users","description":"IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to obtain sensitive information due to improper logging of sensitive credentials.","summary":"IBM Sterling B2B Integrator and Sterling File Gateway write sensitive credentials into their logs. A remote attacker with a valid account can read those credentials and obtain sensitive information.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["b2b-integrator","file-gateway","ibm-sterling","vendor"],"not_affected_if":["no-authenticated-access-to-untrusted-users"],"how_to_check":"- Confirm whether you run IBM Sterling B2B Integrator or Sterling File Gateway, and which version: `unknown` if the sources do not name a check.\n- Check the installed version against the affected ranges: 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1.","fix":null,"status":"open","published_at":"2026-11-08T19:17:40+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","triaged_at":"2026-11-08T19:23:23+00:00","updated_at":"2026-11-08T19:23:23+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T19:23:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Sterling B2B Integrator: logs expose sensitive credentials to authenticated users","impact":"medium","summary":"IBM Sterling B2B Integrator and Sterling File Gateway write sensitive credentials into their logs. A remote attacker with a valid account can read those credentials and obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-sterling","b2b-integrator","file-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker reads sensitive credentials from logs","analyst_note":"Find IBM's security bulletin for CVE-2026-81209 to confirm the fixed versions and which logs leak credentials.","how_to_check":"- Confirm whether you run IBM Sterling B2B Integrator or Sterling File Gateway, and which version: `unknown` if the sources do not name a check.\n- Check the installed version against the affected ranges: 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-authenticated-access-to-untrusted-users"],"who_is_affected":"Teams running IBM Sterling B2B Integrator or Sterling File Gateway Standard Edition in the listed version ranges. The flaw needs a remote account with some access before the attacker can read the logged credentials. The sources do not say what default configuration or logging setting turns the leak on, so unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000763,"input_tokens":4648,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-81209':14A,17A '1':64C,67C,76C,79C '6.2.1.0':61C,73C '6.2.1.2':63C,75C '6.2.2.0':65C,77C '6.2.2.1':66C,78C 'account':48B 'allow':83C 'attack':44B,87C 'authent':10A,86C 'b2b':3A,19B,30B,59C 'b2b-integrator':18B 'could':82C 'credenti':8A,38B,52B,98C 'cve':12A,15A 'due':92C 'edit':81C 'expos':6A 'file':22B,34B,71C 'file-gateway':21B 'gateway':23B,35B,72C 'ibm':1A,25B,28B,57C,69C 'ibm-sterl':24B 'improp':94C 'inform':56B,91C 'integr':4A,20B,31B,60C 'log':5A,41B,95C 'obtain':54B,89C 'read':50B 'remot':43B,85C 'sensit':7A,37B,55B,90C,97C 'standard':80C 'sterl':2A,26B,29B,33B,58C,70C 'user':11A 'valid':47B 'vendor':27B 'write':36B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Sterling B2B Integrator or Sterling File Gateway Standard Edition in the listed version ranges. The flaw needs a remote account with some access before the attacker can read the logged credentials. The sources do not say what default configuration or logging setting turns the leak on, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["b2bintegrator","filegateway","ibmsterling","medium","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-81209':14A,17A 'authent':10A 'b2b':3A 'credenti':8A 'cve':12A,15A 'expos':6A 'ibm':1A 'integr':4A 'log':5A 'sensit':7A 'sterl':2A 'user':11A","search_b":"'account':48B 'attack':44B 'b2b':19B,30B 'b2b-integrator':18B 'credenti':38B,52B 'file':22B,34B 'file-gateway':21B 'gateway':23B,35B 'ibm':25B,28B 'ibm-sterl':24B 'inform':56B 'integr':20B,31B 'log':41B 'obtain':54B 'read':50B 'remot':43B 'sensit':37B,55B 'sterl':26B,29B,33B 'valid':47B 'vendor':27B 'write':36B","search_c":"'1':64C,67C,76C,79C '6.2.1.0':61C,73C '6.2.1.2':63C,75C '6.2.2.0':65C,77C '6.2.2.1':66C,78C 'allow':83C 'attack':87C 'authent':86C 'b2b':59C 'could':82C 'credenti':98C 'due':92C 'edit':81C 'file':71C 'gateway':72C 'ibm':57C,69C 'improp':94C 'inform':91C 'integr':60C 'log':95C 'obtain':89C 'remot':85C 'sensit':90C,97C 'standard':80C 'sterl':58C,70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81209","severity":null,"published_at":"2026-11-08T19:17:40+00:00","modified_at":"2026-11-08T19:17:41+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","fetched_at":"2026-11-08T19:22:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}