CVE-2026-7775 Overview
CVE-2026-7775 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting IBM Sterling B2B Integrator and IBM Sterling File Gateway. A privileged user can embed arbitrary JavaScript code in the Web UI, altering its intended functionality. Successful exploitation can lead to credential disclosure within a trusted user session.
The issue impacts IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. IBM Sterling File Gateway is affected across the same version ranges.
Critical Impact
An authenticated privileged attacker can inject persistent JavaScript into the Web UI, hijacking sessions and exfiltrating credentials from other users interacting with the trusted interface.
Affected Products
- IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6
- IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2 and 6.2.2.0 through 6.2.2.0_1
- IBM Sterling File Gateway 6.2.0.0 through 6.2.2.0_1
Discovery Timeline
- 2026-07-28 - CVE-2026-7775 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-7775
Vulnerability Analysis
CVE-2026-7775 is a stored cross-site scripting flaw in the Web UI of IBM Sterling B2B Integrator and IBM Sterling File Gateway. The application fails to properly sanitize or encode user-supplied input before rendering it in server-generated HTML responses. As a result, JavaScript payloads submitted by a privileged user are stored server-side and executed by any subsequent user who loads the affected view.
Because the payload executes inside a trusted, authenticated session, it inherits the victim's browser context. Attackers can read Document Object Model (DOM) content, exfiltrate session cookies where not marked HttpOnly, and steal credentials entered into forms rendered under attacker control. The scope changes from the vulnerable component to the victim's browser session, which is why the CVSS scope is marked as changed.
Exploitation requires high privileges, limiting opportunistic abuse. However, in multi-tenant B2B integration environments, a compromised administrative account or a malicious insider can pivot to harvest credentials from operators, partners, or auditors who access the Web UI.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. Input accepted from privileged users through administrative fields in the Web UI is stored and later reflected without contextual output encoding. Any content interpreted as executable script by the browser runs with the victim's session privileges.
Attack Vector
The attack vector is network-based over HTTP or HTTPS to the Sterling B2B Integrator or Sterling File Gateway Web UI. An authenticated privileged attacker injects a JavaScript payload into a persistent field that is later rendered to other users. No user interaction with a crafted link is required, since the payload is stored and served from the trusted application. See the IBM Security Update for advisory details.
Detection Methods for CVE-2026-7775
Indicators of Compromise
- Unexpected <script>, onerror, onload, or javascript: fragments stored in Sterling B2B Integrator configuration fields, partner metadata, or file gateway routing objects.
- Outbound HTTP requests from operator browsers to unfamiliar domains shortly after loading Sterling Web UI pages.
- Anomalous administrative account activity that precedes editing of shared Web UI content or partner profiles.
Detection Strategies
- Review Sterling B2B Integrator audit logs for edits to fields rendered in the Web UI by privileged accounts.
- Inspect stored database content for HTML tags or JavaScript event handlers in fields that should contain plain text.
- Deploy Content Security Policy (CSP) violation reporting to surface script executions from unexpected sources.
Monitoring Recommendations
- Alert on privileged account logins from new IP addresses or outside expected maintenance windows.
- Monitor Web UI HTTP responses for reflected script content using a web application firewall (WAF) in detection mode.
- Correlate administrative changes in Sterling with subsequent session anomalies affecting other user accounts.
How to Mitigate CVE-2026-7775
Immediate Actions Required
- Apply the fixed release identified in the IBM Security Update for Sterling B2B Integrator and Sterling File Gateway.
- Audit all privileged accounts and revoke unused administrative access to reduce the pool of users capable of triggering this flaw.
- Review stored content in Web UI fields and remove any embedded HTML or JavaScript introduced by privileged users.
Patch Information
IBM has published fixed versions and remediation guidance in the vendor advisory. Refer to the IBM Security Update for the specific fix packs applicable to each affected 6.2.x branch and apply them per IBM's upgrade procedure.
Workarounds
- Restrict Web UI access to trusted management networks using network access controls or VPN gating.
- Enforce a strict Content Security Policy that disallows inline scripts and unapproved external script sources.
- Require multi-factor authentication for all privileged Sterling accounts to reduce the likelihood of account takeover leading to stored XSS injection.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
