← Vulnerability feed

Vulnerability record · CVE-2025-36368 · published 13 March 2026

CVE-2025-36368: Ibm sterling b2b integrator sql injection vulnerability

Ibm · Sterling B2b Integrator

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to SQL injection. An administrative user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

7.2 CVSS 3.1 High EPSS 0.31% · top 78.2% CWE-89 · SQL injection
7.2CVSS 3.1 base score
0.31%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to SQL injection. An administrative user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7263324 Vendor Advisory

Track CVE-2025-36368 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2015-7450IBM products Java deserialization RCE via Commons CollectionsMultiple IBM analytics, business, IT infrastructure, and mobile/social products expose serialized-object interfaces that deserialize untrusted Java o…KEVEPSS 98%analysed9.8CVE-2023-50316Ibm sterling b2b integrator sql injection vulnerabilityIBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 is vulnerable to SQL injection. A remote attacker could send speciall…EPSS 0.35%9.8CVE-2022-22338Ibm sterling b2b integrator sql injection vulnerabilityIBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted S…EPSS 0.68%9.8CVE-2021-39085Ibm sterling b2b integrator sql injection vulnerabilityIBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to SQL injec…EPSS 0.92%9.8CVE-2021-29798Ibm sterling b2b integrator sql injection vulnerabilityIBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted S…EPSS 1.1%9.8CVE-2021-29903Ibm sterling b2b integrator sql injection vulnerabilityIBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 6.1.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted S…EPSS 1.1%9.3CVE-2012-5937Ibm gentran integration suite vulnerabilityUnspecified vulnerability in the CLA2 server in IBM Gentran Integration Suite 4.3, Sterling Integrator 5.0 and 5.1, and Sterling B2B Integrator 5.2, …EPSS 2.6%8.8CVE-2023-38739Ibm sterling b2b integrator cross-site request forgery vulnerabilityIBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site request forgery which could allow an atta…EPSS 0.17%

Source: NIST National Vulnerability Database (record CVE-2025-36368), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.