CVE-2026-7362: IBM Sterling B2B Integrator and File Gateway improper access control

CVE-2026-7362 · Severity: medium · CVSS 4.3 · Published 2026-07-28

IBM Sterling B2B Integrator and Sterling File Gateway are platforms used by organizations to manage complex data exchanges and file transfers with business partners. A security vulnerability in these systems could allow a standard user to access sensitive information that is normally restricted to administrators. This could lead to the unauthorized disclosure of internal configuration details or business data, though it requires the attacker to already have a valid user account.

Technologies: IBM Sterling File Gateway, IBM Sterling B2b Integrator. Vendors: IBM.

Quick answers

Is CVE-2026-7362 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7362 being exploited in the wild.
How severe is CVE-2026-7362?
Medium severity, with a CVSS score of 4.3, published 28 July 2026.
Which products and versions are affected?
IBM Sterling File Gateway 6.2.1.0 - 6.2.1.1_2, 6.2.2.0 - 6.2.2.0_1; IBM Sterling B2b Integrator 6.2.1.0 - 6.2.1.1_2, 6.2.2.0 - 6.2.2.0_1.
Is there a fix for CVE-2026-7362?
A patch was published on 2026-07-22: Fixes released in versions 6.2.1.2 and 6.2.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7362 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-7362?
Check whether you run IBM Sterling File Gateway or IBM Sterling B2b Integrator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-284) exists in IBM Sterling B2B Integrator and IBM Sterling File Gateway. The flaw allows a remote authenticated attacker with low privileges to bypass intended access restrictions and view sensitive information that should be restricted to administrative or privileged users. The vulnerability is reachable via the network and does not require user interaction. IBM has released patches to address this issue in versions 6.2.1.2 and 6.2.2.1.

Affected products

  • IBM Sterling B2B Integrator 6.2.1.0 - 6.2.1.1_2, 6.2.2.0 - 6.2.2.0_1
  • IBM Sterling File Gateway 6.2.1.0 - 6.2.1.1_2, 6.2.2.0 - 6.2.2.0_1

Timeline

  • 2026-07-22: disclosed: Initial publication by IBM
  • 2026-07-22: patched: Fixes released in versions 6.2.1.2 and 6.2.2.1
  • 2026-07-28: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.