BaseFortify

Publication date: 2026-01-20

Last updated on: 2026-02-03

Assigner: IBM Corporation

Description

IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-20

Last Modified

2026-02-03

Generated

2026-07-06

AI Q&A

2026-01-20

EPSS Evaluated

2026-07-05

NVD

CVE-2025-36065

EUVD

EUVD-2026-3367

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	sterling_connect\	express_adapter_for_sterling_b2b_integrator

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability exists in IBM Sterling Connect:Express Adapter for Sterling B2B Integrator versions 5.2.0.00 through 5.2.0.12. It occurs because the system does not invalidate user sessions after a browser is closed. As a result, an authenticated user could potentially impersonate another user on the system.

Impact Analysis

The vulnerability could allow an authenticated user to impersonate another user, which may lead to unauthorized access to sensitive information or actions performed under another user's identity. This can compromise the integrity and confidentiality of the system and its data.

Hi! I’m here to help you understand CVE-2025-36065. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70