CVE-2026-75878

CriticalCVSS 9.1

Published: 18/09/2026(UTC)Updated: 22/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

40th percentile - higher than 40% of all known CVEs

Summary

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header.

Risk Assessment

An unauthenticated attacker could gain full access to the system, potentially leading to compromise of confidentiality, integrity, and availability of processed data.

Recommendation

Immediately apply available security patches for IBM Sterling File Gateway and implement server-side validation of SSO headers.

Other vulnerabilities in IBM Sterling File Gateway

CVE-2026-19290High
IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 through 6.2.1.2, and 6.2.2.0 through 6.2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.

Original NVD description (English source)

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS