CVE-2026-1264

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 allows a remote unauthenticated attacker to view and delete the partners of a community and to delete the communities.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
IBMSterling B2B Integrator>= 6.1.0.0, <= 6.1.2.7_2; >= 6.2.0.0, <= 6.2.0.5_1; >= 6.2.1.0, <= 6.2.1.1_1; 6.2.2.0

References

Timeline

Published
Mar 17, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-126445.3Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.protoCVE-2026-126458.8A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary cCVE-2026-126468.8A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary cCVE-2026-126478.8A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary cCVE-2026-126488.8A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to executeCVE-2026-12655.3IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to writing of sensitive Information in a log file.CVE-2026-126508.8A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to executeCVE-2026-126518.8A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to executeCVE-2026-126545.3The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, CVE-2026-126558.8A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without vCVE-2026-126568.7A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network stCVE-2026-126575.3The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference i
CVE-2026-1264: Medium severity, CVSS 6.5 | Vulnix