CVE-2026-19273: IBM Sterling B2B Integrator and File Gateway improper authentication in Dashboard

CVE-2026-19273 · Severity: medium · CVSS 5.4 · Published 2026-09-14

IBM Sterling B2B Integrator and File Gateway are enterprise integration platforms used to manage secure data exchanges and file transfers between business partners. A remote authenticated attacker can bypass security restrictions in the Dashboard component due to improper authentication controls, allowing unauthorized access to sensitive functionality. This vulnerability requires valid login credentials but could enable attackers with legitimate access to escalate privileges or access data they should not be able to reach.

Technologies: IBM Sterling File Gateway, IBM Sterling B2b Integrator. Vendors: IBM.

Quick answers

Is CVE-2026-19273 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19273 being exploited in the wild.
How severe is CVE-2026-19273?
Medium severity, with a CVSS score of 5.4, published 14 September 2026.
Which products and versions are affected?
IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 through 6.2.1.2, 6.2.2.0 through 6.2.2.1; IBM Sterling B2b Integrator 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 through 6.2.1.2, 6.2.2.0 through 6.2.2.1.
Is there a fix for CVE-2026-19273?
A patch was published on 2026-09-14: Fixes 6.2.1.2_1 and 6.2.2.1_1 available on Fix Central Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19273 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-19273?
Check whether you run IBM Sterling File Gateway or IBM Sterling B2b Integrator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as improper authentication (CWE-287) affecting the Dashboard component of both IBM Sterling B2B Integrator and File Gateway versions 6.2.0.0 through 6.2.2.1. The root cause is inadequate authentication validation that allows authenticated users to bypass security restrictions. The attack vector is network-based and requires prior authentication; no user interaction is necessary once an attacker has valid credentials. An authenticated attacker can circumvent access controls to perform unauthorized operations. IBM has released patches (6.2.1.2_1 and 6.2.2.1_1) available through Fix Central and container registries to remediate this issue.

Affected products

  • IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 through 6.2.1.2, 6.2.2.0 through 6.2.2.1
  • IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 through 6.2.1.2, 6.2.2.0 through 6.2.2.1

Timeline

  • 2026-09-14: disclosed: Security bulletin published
  • 2026-09-14: patched: Fixes 6.2.1.2_1 and 6.2.2.1_1 available on Fix Central

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.