Loading vulnerability…
Improper Access Control in IBM Sterling File Gateway
CVE-2026-19290 is an improper access-control vulnerability in IBM Sterling File Gateway. It affects versions 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 through 6.2.1.2, and 6.2.2.0 through 6.2.2.1. Insufficient access controls allow a remote attacker to obtain sensitive information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote, unauthenticated attacker can disclose sensitive information. The vulnerability has a CVSS v3.1 base score of 7.5 (High), with high confidentiality impact and no stated integrity or availability impact.
If you can’t patch tonight, do this now.
No vendor workaround or mitigation is available. Remediation requires applying the applicable fixed release.
Patch, then assume compromise.
Apply IBM APAR IT49875 by upgrading affected deployments to 6.2.0.6_2, 6.2.1.2_1, or 6.2.2.1_1, as applicable. Version 6.2.0.6_2 is available through IBM Support; the later fixed releases are available through IBM Fix Central and as container releases through the IBM Entitled Registry.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.