SB20260917195 - Multiple vulnerabilities in IBM Sterling B2B Integrator and IBM Sterling File Gateway
Published: September 17, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2026-22745)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in static resource handling when resolving static resources from the file system on Windows platforms. A remote attacker can send malicious requests that are slow to resolve to cause a denial of service.
The issue affects applications using Spring MVC or Spring WebFlux that serve static resources from the file system on Windows platforms.
2) Acceptance of Extraneous Untrusted Data With Trusted Data (CVE-ID: CVE-2026-22741)
CWE-ID: CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted Data
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper cache control in static resource resolution when handling malicious requests for encoded resources. A remote attacker can send malicious requests to cause a denial of service.
Exploitation requires resource chain support with caching enabled, encoded resource resolution enabled, and an empty resource cache.
3) Session Fixation (CVE-ID: CVE-2026-41839)
CWE-ID: CWE-384 - Session Fixation
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and modify data associated with an authenticated user's session.
The vulnerability exists due to improper session management in the WebFlux session handling mechanism when processing requests from a compromised subdomain. A remote attacker can exchange a known session ID for that of an authenticated user to disclose sensitive information and modify data associated with an authenticated user's session.
Exploitation requires user interaction and a compromised subdomain, for example through cross-site scripting.
4) Memory leak (CVE-ID: CVE-2026-41840)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory leakage in multipart request processing in Spring WebFlux when processing multipart requests. A remote attacker can send malicious multipart requests to cause a denial of service.
The issue affects applications that implement a web endpoint that receives multipart requests.
5) Cross-site scripting (CVE-ID: CVE-2026-41845)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.
The vulnerability exists due to incorrect escaping in JavaScriptUtils.javaScriptEscape() when processing input for JavaScript output. A remote attacker can supply crafted input to execute arbitrary script code in the victim's browser.
User interaction is required to load the affected content in a browser.
6) Input validation error (CVE-ID: CVE-2026-41853)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass WAF or proxy checks.
The vulnerability exists due to improper input validation in multipart request handling in Spring MVC and Spring WebFlux when processing multipart requests. A remote attacker can send a malicious multipart request to bypass WAF or proxy checks.
Exploitation requires the application to accept multipart requests and to be protected by a WAF or proxy that parses multipart requests and performs checks based on their content.
7) Input validation error (CVE-ID: CVE-2026-41854)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to incorrect host parsing in uricomponentsbuilder when parsing and validating an externally provided URL string. A remote attacker can supply a crafted URL string to perform server-side request forgery.
User interaction is required.
8) Improper access control (CVE-ID: CVE-2026-41841)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in the static resource cache in Spring MVC and Spring WebFlux when resolving static resources. A remote attacker can request a publicly available resource with the same name as a protected resource to disclose sensitive information.
Exploitation requires several resource handlers using different resource locations, at least one protected resource handler, and a shared cache across these configurations.
9) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-40999)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to improper input validation in AbstractAddressingEndpointMapping handling of WS-Addressing reply destinations when processing non-anonymous ReplyTo or FaultTo addresses from request headers. A remote attacker can supply crafted WS-Addressing headers to perform server-side request forgery.
Only deployments with one or more configured WebServiceMessageSender instances for out-of-band replies that accept WS-Addressing headers from untrusted callers are vulnerable.
Remediation
Install update from vendor's website.