# CVE-2026-1918: IBM Sterling B2B Integrator sensitive information disclosure in logs

Source: https://junglewise.ai/threats/cve-2026-1918-ibm-sterling-b2b-integrator-sensitive-information-disclosure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-1918 · Severity: medium · CVSS 4.9 · Published 2026-07-28

IBM Sterling B2B Integrator and Sterling File Gateway are platforms used by organizations to manage secure file transfers and business-to-business transactions. A vulnerability in these systems causes sensitive information to be recorded in plain text within system log files. If an authorized user with high-level privileges accesses these logs, they could view confidential data that should otherwise be protected, potentially leading to further unauthorized access or data exposure.

Technologies: [IBM Sterling File Gateway](https://junglewise.ai/threats/technologies/sterling-file-gateway), [IBM Sterling B2b Integrator](https://junglewise.ai/threats/technologies/sterling-b2b-integrator). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-1918 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1918 being exploited in the wild.

**How severe is CVE-2026-1918?** Medium severity, with a CVSS score of 4.9, published 28 July 2026.

**Which products and versions are affected?** IBM Sterling File Gateway 6.2.0.0 - 6.2.0.5_2, 6.2.1.0 - 6.2.1.1_2, 6.2.2.0 - 6.2.2.0_1; IBM Sterling B2b Integrator 6.2.0.0 - 6.2.0.5_2, 6.2.1.0 - 6.2.1.1_2, 6.2.2.0 - 6.2.2.0_1.

**Is there a fix for CVE-2026-1918?** A patch was published on 2026-07-21: Fixes released in versions 6.2.0.6, 6.2.1.2, and 6.2.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-1918 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-1918?** Check whether you run IBM Sterling File Gateway or IBM Sterling B2b Integrator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File). It affects the logging mechanisms of IBM Sterling B2B Integrator and Sterling File Gateway, where sensitive data is inadvertently written to logs in a readable format. An attacker must have high-level administrative or system privileges (PR:H) to access these log files. While the attack vector is listed as network-based, the primary risk is the exposure of confidential information to internal users who have the authority to view system logs but should not have access to the specific sensitive data contained within them. IBM has released patches (6.2.0.6, 6.2.1.2, and 6.2.2.1) to remediate this issue.

## Affected products

- IBM Sterling B2B Integrator 6.2.0.0 - 6.2.0.5_2, 6.2.1.0 - 6.2.1.1_2, 6.2.2.0 - 6.2.2.0_1
- IBM Sterling File Gateway 6.2.0.0 - 6.2.0.5_2, 6.2.1.0 - 6.2.1.1_2, 6.2.2.0 - 6.2.2.0_1

## Timeline

- 2026-07-21: disclosed: Initial publication by IBM
- 2026-07-21: patched: Fixes released in versions 6.2.0.6, 6.2.1.2, and 6.2.2.1
- 2026-07-28: advisory: NVD publication date

## References

- [https://www.ibm.com/support/pages/node/7280658](https://www.ibm.com/support/pages/node/7280658)

## Related threats

- [IBM Sterling B2B Integrator and File Gateway sensitive information in logs](https://junglewise.ai/threats/cve-2026-81209-ibm-sterling-b2b-integrator-6-2-1-0-through-6-2-1-2-1-6-2-2-0-6-2)
- [IBM Sterling B2B Integrator and File Gateway improper authorization](https://junglewise.ai/threats/cve-2026-19307-ibm-sterling-b2b-integrator-6-2-1-0-through-6-2-1-2-1-and-6-2-2-0)
- [IBM Sterling File Gateway protocol downgrade via security misconfiguration](https://junglewise.ai/threats/cve-2026-18668-ibm-sterling-file-gateway-6-2-1-0-through-6-2-1-2-1-and-6-2-2-0-6)
- [IBM Sterling B2B Integrator sensitive information disclosure in logs](https://junglewise.ai/threats/cve-2026-12737-ibm-sterling-b2b-integrator-6-2-2-0-through-6-2-2-1-1-and-ibm)
- [IBM Sterling File Gateway authentication bypass via unvalidated SSO header](https://junglewise.ai/threats/cve-2026-75878-ibm-sterling-file-gateway-could-allow-a-remote-attacker-to-bypass)