CVE-2026-19290

IBM Sterling File Gateway contains an improper access control flaw (CWE-284) that could allow a remote attacker to obtain sensitive information without any authentication or user interaction. The vulnerability affects the 6.2.x release streams from 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 through 6.2.1.2, and 6.2.2.0 through 6.2.2.1, and is triggered by sending unauthenticated requests to an insufficiently protected interface or resource. An attacker gains read access to sensitive data (high confidentiality impact) but cannot modify data or cause denial of service, per the CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Organizations using these managed file transfer deployments for B2B data exchange are affected. The flaw is not in the CISA Known Exploited Vulnerabilities catalog and no public proof of concept or observed exploitation is known.

What to do: Apply IBM's fixed builds for the 6.2.0, 6.2.1, and 6.2.2 streams as described in the IBM security bulletin for this CVE. Until patched, restrict network access to Sterling File Gateway interfaces (UI, API, and HTTP-based endpoints) to trusted VPN/internal ranges and enforce authentication at a reverse proxy. Review access logs for unauthenticated requests to sensitive resources from unexpected sources to rule out prior data exposure.