IBM Sterling Connect:Direct 4.5.00, 4.5.01, 4.6.0 before 4.6.0.6 iFix008, and 4.7.0…
Priority LOW 20CWE-264Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-264.
Summary
IBM Sterling Connect:Direct 4.5.00, 4.5.01, 4.6.0 before 4.6.0.6 iFix008, and 4.7.0 before 4.7.0.4 on Windows allows local users to gain privileges via unspecified vectors.
Why it matters now
EPSS 0.00269 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:sterling_connect\:direct:4.5:*:*:*:*:windows:*:* | direct 4.5 | Vulnerable | IBM |
| cpe:2.3:a:ibm:sterling_connect\:direct:4.5.01:*:*:*:*:windows:*:* | direct 4.5.01 | Vulnerable | IBM |
| cpe:2.3:a:ibm:sterling_connect\:direct:4.6:*:*:*:*:windows:*:* | direct 4.6 | Vulnerable | IBM |
| cpe:2.3:a:ibm:sterling_connect\:direct:4.7:*:*:*:*:windows:*:* | direct 4.7 | Vulnerable | IBM |
- cpe:2.3:a:ibm:sterling_connect\:direct:4.5:*:*:*:*:windows:*:* Versions direct 4.5 Vulnerable ·IBM
- cpe:2.3:a:ibm:sterling_connect\:direct:4.5.01:*:*:*:*:windows:*:* Versions direct 4.5.01 Vulnerable ·IBM
- cpe:2.3:a:ibm:sterling_connect\:direct:4.6:*:*:*:*:windows:*:* Versions direct 4.6 Vulnerable ·IBM
- cpe:2.3:a:ibm:sterling_connect\:direct:4.7:*:*:*:*:windows:*:* Versions direct 4.7 Vulnerable ·IBM
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-5991
- 2026-10-03 Alias added: GHSA-757w-3xwr-7h7f
References
More IBM Sterling Connect vulnerabilities
- TI-2021-16346 Missing brute-force protection in IBM Connect:Direct Web Services CVSS 3.1HIGH 7.5
- TI-2020-04041 Out-of-bounds read in IBM Sterling Connect Direct for Microsoft Windows CVSS 3.1HIGH 7.5
- TI-2023-13665 IBM Sterling Connect:Express for UNIX server-side request forgery CVSS 3.1MEDIUM 6.5
- TI-2025-24718 IBM Sterling Connect:Direct for UNIX command execution CVSS 3.1HIGH 7.2
- TI-2023-15624 IBM Connect:Express for UNIX denial of service CVSS 3.1HIGH 7.5
- TI-2021-16347 IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected… CVSS 3.1HIGH 7.5
Sources
- CVE-2016-5991 · CVE Program
- CVE-2016-5991 · NVD
- FIRST EPSS
- GHSA-757w-3xwr-7h7f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences