CVE-2026-7775

The stored XSS in IBM Sterling B2B Integration versions 6.2.0.0 through 6.2.0.6 targets the administrative UI where credential and certificate material is exposed during active sessions. While the CVSS 5.5 rating reflects that exploitation requires a privileged account, this metric underweights the actual blast radius in B2B contexts — because the compromised session already carries the keys to your organization's external trading partner relationships, API credentials, and certificate stores. A stored XSS here isn't just script execution in a browser; it's a precision tool for exfiltrating the credential material that governs multi-organizational data flows. The more important question is whether this vulnerability represents a one-off input sanitization gap or a recurring pattern. B2B integration platforms have extremely long upgrade cycles, and organizations running 6.2.0.x often do so because migration costs cross business justification thresholds. This means production instances accumulate sanitization patches layered over sanitization patches — a palimpsest where each medium-rated fix preserves the underlying assumption that privileged UI sessions are safe contexts. If this is the second or third XSS fix in this credential-adjacent UI layer across recent versions, the narrow patch interpretation becomes evidence of systemic architectural debt, not exculpation. What you should do: First, verify the patch is deployed — this affects all 6.2.0.x deployments. Second, treat the severity assessment as a floor, not a ceiling: assume credential material may have been accessible during the window before patching, and plan accordingly. Third, inventory all trading partner credentials and certificates managed through this instance — because if exploitation occurred, the blast radius crosses your organizational boundary to every organization connected through those relationships. Fourth, examine authentication logs for any administrative session anomalies during the pre-patch window, looking for unexpected data transfers or credential access patterns. The EPSS low probability score reflects the absence of public exploit code, not the absence of targeted campaigns against high-value B2B platforms — those operations don't surface in the telemetry that drives probability modeling. The architectural question this CVE raises is whether B2B platforms should isolate administrative UI sessions from credential stores, assuming that any privileged account may eventually be compromised. That level of defense-in-depth is expensive, which is likely why the patch itself was narrow. But for platforms that aggregate trust relationships across organizational boundaries, the cost of that isolation may be cheaper than the remediation when a medium-rated XSS becomes a supply chain compromise.

Reviewed through automated stages and approved by a human before publication.