IBM Sterling File Gateway information disclosure
Priority LOW 20CWE-548Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 could disclose sensitive installation directory information to an authenticated user that could be used in further attacks against the system.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Sterling File Gateway | 6.0.0.0 – 6.1.2.6; 6.2.0.0 – 6.2.0.4 | — | No fix listed | CNA |
- Sterling File Gateway VendorIBM Affected 6.0.0.0 – 6.1.2.6; 6.2.0.0 – 6.2.0.4 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:sterling_file_gateway:*:*:*:*:*:*:*:* | 6.0.0.0 to before 6.1.2.7_1; 6.2.0.0 to before 6.2.0.5 | Vulnerable | IBM |
| cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:ibm:sterling_file_gateway:*:*:*:*:*:*:*:* Versions 6.0.0.0 to before 6.1.2.7_1; 6.2.0.0 to before 6.2.0.5 Vulnerable ·IBM
- cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-2827
- 2026-10-03 Alias added: GHSA-hrwx-69c9-h8qq
References
More IBM Sterling File Gateway vulnerabilities
- TI-2013-03496 XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime… CVSS 2.0HIGH 7.1
- TI-2012-04950 Unspecified vulnerability in the CLA2 server in IBM Gentran Integration Suite 4.3… CVSS 2.0HIGH 9.3
- TI-2020-03955 SQL injection in IBM Sterling File Gateway CVSS 3.1HIGH 8.8
- TI-2014-00854 The ActiveMQ admin user interface in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling… CVSS 3.0HIGH 8.1
- TI-2025-12821 IBM Sterling B2B Integrator and IBM Sterling File Gateway Denial of Service CVSS 3.1HIGH 7.5
- TI-2026-06843 SQL injection Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway CVSS 3.1HIGH 8.1
Sources
- CVE-2025-2827 · CVE Program
- CVE-2025-2827 · NVD
- FIRST EPSS
- GHSA-hrwx-69c9-h8qq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences