# CVE-2026-12737: IBM Sterling B2B Integrator sensitive information disclosure in logs

Source: https://junglewise.ai/threats/cve-2026-12737-ibm-sterling-b2b-integrator-6-2-2-0-through-6-2-2-1-1-and-ibm  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-12737 · Severity: medium · CVSS 4.4 · Published 2026-11-08

IBM Sterling B2B Integrator and File Gateway are business integration platforms that process and route sensitive documents and data between trading partners. Both products store potentially sensitive information in log files that could be read by a local privileged user with elevated system access, risking exposure of confidential business data. An authenticated local administrator could extract this sensitive data from system logs.

Technologies: [IBM Sterling File Gateway](https://junglewise.ai/threats/technologies/sterling-file-gateway), [IBM Sterling B2b Integrator](https://junglewise.ai/threats/technologies/sterling-b2b-integrator). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-12737 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12737 being exploited in the wild.

**How severe is CVE-2026-12737?** Medium severity, with a CVSS score of 4.4, published 8 November 2026.

**Which products and versions are affected?** IBM Sterling File Gateway 6.2.2.0 through 6.2.2.1_1; IBM Sterling B2b Integrator 6.2.2.0 through 6.2.2.1_1.

**Is there a fix for CVE-2026-12737?** Yes: fixed in Sterling B2B Integrator 6.2.2.2; Sterling File Gateway 6.2.2.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12737 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-12737?** Check whether you run IBM Sterling File Gateway or IBM Sterling B2b Integrator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Sterling B2B Integrator 6.2.2.2; Sterling File Gateway 6.2.2.2

## Technical details

The vulnerability is an insertion of sensitive information into log files (CWE-532) affecting log file handling in Sterling B2B Integrator and File Gateway. An attacker requires local access and high privileges (administrator-level credentials) to read the log files and extract sensitive data; no network or user interaction is required once local privilege is obtained. The issue was fixed in version 6.2.2.2.

## Affected products

- IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.1_1
- IBM Sterling File Gateway 6.2.2.0 through 6.2.2.1_1

## Timeline

- 2026-10-22: disclosed

## References

- [https://www.ibm.com/support/pages/node/7293719](https://www.ibm.com/support/pages/node/7293719)

## Related threats

- [IBM Sterling B2B Integrator and File Gateway sensitive information in logs](https://junglewise.ai/threats/cve-2026-81209-ibm-sterling-b2b-integrator-6-2-1-0-through-6-2-1-2-1-6-2-2-0-6-2)
- [IBM Sterling B2B Integrator and File Gateway improper authorization](https://junglewise.ai/threats/cve-2026-19307-ibm-sterling-b2b-integrator-6-2-1-0-through-6-2-1-2-1-and-6-2-2-0)
- [IBM Sterling File Gateway protocol downgrade via security misconfiguration](https://junglewise.ai/threats/cve-2026-18668-ibm-sterling-file-gateway-6-2-1-0-through-6-2-1-2-1-and-6-2-2-0-6)
- [IBM Sterling File Gateway authentication bypass via unvalidated SSO header](https://junglewise.ai/threats/cve-2026-75878-ibm-sterling-file-gateway-could-allow-a-remote-attacker-to-bypass)
- [IBM Sterling File Gateway improper access control](https://junglewise.ai/threats/cve-2026-19290-ibm-sterling-file-gateway-improper-access-control)