IBM Sterling B2B Integrator SQL Injection Vulnerability (CVE-2026-7253) Advisory

IBM Sterling B2B Integrator and IBM Sterling File Gateway SQL Injection Vulnerability (CVE-2026-7253) Vulnerability Overview A SQL injection vulnerability exists in IBM Sterling B2B Integrator and IBM Sterling File Gateway. Attackers can view, add, modify, or delete information in the backend database by injecting carefully crafted SQL statements. CVE ID: CVE-2026-7253 Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to SQL injection attacks. Privileged users can leverage specially crafted SQL statements, allowing attackers to view, add, modify, or delete information in the backend database. CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVSS Source: IBM CVSS Base Score: 5.3 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Affected Products Affected Products: - IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.1.0 – 6.2.1.1.2 - IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.2.0 – 6.2.2.0.1 Software Versions: 6.0.0.0 – 6.2.2.1 Operating Systems: AIX, Windows, Linux Remediation Remediated Versions: - IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.1.0 – 6.2.1.1.2: Apply B2Bi 6.2.1.2, 6.2.2.1 - IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.2.0 – 6.2.2.0.1: Apply B2Bi 6.2.2.1 Acquiring Remediation: - IIM versions 6.2.1.2 and 6.2.2.1 are available on Fix Central. - Container versions 6.2.1.2 and 6.2.2.1 are available on the IBM Entitled Registry. Additional Information Workarounds and Mitigations: None References: - Complete CVSS v3 Guide - On-line Calculator v3 Related Resources: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer Per Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard” designed to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores “as is” without any express or implied warranties. It is the customer’s responsibility to assess the actual or potential impact of the vulnerability on their environment. IBM periodically updates its product component records but does not indicate that a product has been used by IBM since an old CVE date referenced. IBM strives to inform customers about relevant vulnerabilities, but “Affected Products and Versions” refers only to IBM-supported products and versions within their support period. Failure to reference unsupported or Extended Support products and versions does not constitute a determination that IBM products are not affected by the vulnerability. Referencing one or more unsupported versions in this security advisory does not impose an obligation on IBM to remediate unsupported or Extended Support product versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Sterling B2B Integrator SQL Injection Vulnerability (CVE-2026-7253) Advisory

More from this source