CVE-2025-36431: IBM Sterling B2B Integrator and File Gateway cross-site scripting in Web UI

CVE-2025-36431 · Severity: medium · CVSS 5.4 · Published 2026-07-30

IBM Sterling B2B Integrator and Sterling File Gateway, which are used by organizations to securely exchange and manage large volumes of electronic data with partners, are affected by a security flaw in their web interface. An authenticated user could inject malicious scripts into the system's management console. If another user views the affected page, the script could run in their browser, potentially allowing the attacker to steal login credentials or perform unauthorized actions within the application.

Technologies: IBM Sterling File Gateway, IBM Sterling B2b Integrator. Vendors: IBM.

Quick answers

Is CVE-2025-36431 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-36431 being exploited in the wild.
How severe is CVE-2025-36431?
Medium severity, with a CVSS score of 5.4, published 30 July 2026.
Which products and versions are affected?
IBM Sterling File Gateway 6.2.2.0 - 6.2.2.0_1; IBM Sterling B2b Integrator 6.2.2.0 - 6.2.2.0_1.
Is there a fix for CVE-2025-36431?
A patch was published on 2026-07-21: Fix released in version 6.2.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-36431 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-36431?
Check whether you run IBM Sterling File Gateway or IBM Sterling B2b Integrator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.2.2.0 through 6.2.2.0_1. The flaw is rooted in the improper neutralization of input during web page generation (CWE-79), specifically involving response headers. An authenticated attacker can exploit this by embedding malicious JavaScript code into the Web UI. Successful exploitation requires a victim to interact with the affected component, at which point the script executes in the context of the victim's session, potentially leading to session hijacking or credential disclosure. The issue is resolved in version 6.2.2.1.

Affected products

  • IBM Sterling B2B Integrator 6.2.2.0 - 6.2.2.0_1
  • IBM Sterling File Gateway 6.2.2.0 - 6.2.2.0_1

Timeline

  • 2026-07-21: disclosed: Initial publication by IBM
  • 2026-07-21: patched: Fix released in version 6.2.2.1
  • 2026-07-30: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.