CVE-2026-7775 in Sterling B2B Integrator
Summary
by MITRE • 07/28/2026
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability identified in IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 represents a critical stored cross-site scripting flaw that fundamentally compromises the security posture of these enterprise integration platforms. This vulnerability falls under CWE-79, which specifically addresses cross-site scripting conditions where malicious scripts are injected into web applications and subsequently executed in the context of other users' browsers. The flaw exists within the web user interface components of these products, creating an attack vector that can be exploited by authenticated users with sufficient privileges to manipulate input fields or configuration parameters that are then stored and later rendered without proper sanitization.
The technical implementation of this vulnerability stems from inadequate input validation and output encoding mechanisms within the web application layers of these IBM products. When privileged users interact with the administrative interfaces, they can inject malicious JavaScript payloads through various input points including configuration settings, user-defined data fields, or parameter values that are subsequently stored in the application's database or configuration files. These stored scripts become active whenever other users access the affected web pages, executing in their browser contexts and potentially leveraging their authenticated sessions to perform unauthorized actions. The vulnerability is particularly concerning because it operates at the application layer where legitimate administrative activities occur, making detection more challenging as malicious code becomes indistinguishable from normal application behavior.
The operational impact of this stored cross-site scripting vulnerability extends far beyond simple data corruption or display manipulation. An attacker who successfully exploits this weakness can potentially escalate privileges, gain access to sensitive information, and compromise the integrity of the entire integration platform. The attack could lead to credential theft through session hijacking, where malicious scripts capture authentication tokens or login credentials from users' browsers during their normal operations. Additionally, the vulnerability enables potential data exfiltration attacks where stolen session cookies or sensitive configuration data can be transmitted to external attacker-controlled servers. The trusted session compromise aspect is particularly dangerous as it allows attackers to operate within the legitimate user's privilege context, making their activities appear authentic and potentially bypassing traditional security controls that monitor for suspicious behavior.
Mitigation strategies for this vulnerability must address both immediate remediation and long-term architectural improvements to prevent similar issues in future deployments. Organizations should immediately apply the vendor-provided security patches and updates released specifically to address this cross-site scripting vulnerability, as these updates typically include proper input sanitization and output encoding mechanisms that prevent malicious script injection. Network segmentation and access control measures should be strengthened to limit the number of privileged accounts and reduce the attack surface available to potential adversaries. Implementing web application firewalls with specific rules designed to detect and block common XSS payload patterns can provide additional protection layers, while regular security scanning and penetration testing should be conducted to identify any remaining vulnerabilities in the application stack. The vulnerability also highlights the importance of following secure coding practices and implementing proper input validation at all levels of application development, aligning with ATT&CK technique T1566 which addresses the exploitation of web application vulnerabilities for initial access and privilege escalation purposes.