CVE-2016-9991: IBM Sterling Selling And Fulfillment Foundation

High severity, CVSS 8.0. EPSS: 0.6% chance of exploitation in the next 30 days.

IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 121314.

Affected products

• IBM Sterling Selling And Fulfillment Foundation: version 9.2.0 only; version 9.2.1 only; version 9.3.0 only; version 9.4.0 only; version 9.5.0 only

Published 2017-06-08. Last modified 2026-06-17.