IBM Sterling Connect:direct vulnerabilities

9 CVEs affecting IBM Sterling Connect:direct, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36137, published 2025-10-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4767, published 2020-10-28. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Sterling Connect Direct for Microsoft Windows 4.7, 4.8, 6.0, and 6.1 could allow a remote attacker to cause a denial of service, caused by a buffer over-read. Bysending a specially crafted…
CVE-2021-38890, published 2021-11-23. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 209507.
CVE-2021-38891, published 2021-11-23. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 209508.
CVE-2018-1903, published 2019-04-10. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD UNIX to gain full sudo access. IBM X-Force ID: 152532.
CVE-2025-36137, published 2025-10-30. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly assigns permissions for maintenance tasks to…
CVE-2020-4587, published 2020-08-24. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, 6.0.0, and 6.1.0 is vulnerable to a stack based buffer ovreflow, caused by improper bounds checking. A local attacker could manipulate CD UNIX to…
CVE-2016-0380, published 2016-08-08. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, which allows local users to obtain sensitive information via…
CVE-2016-5992, published 2016-11-25. Low severity, CVSS 2.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sterling Connect:Direct 4.5.00, 4.5.01, 4.6.0 before 4.6.0.6 iFix008, and 4.7.0 before 4.7.0.4 on Windows allows local users to cause a denial of service via unspecified vectors.
CVE-2016-5991, published 2016-11-25. Medium severity, CVSS 4.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sterling Connect:Direct 4.5.00, 4.5.01, 4.6.0 before 4.6.0.6 iFix008, and 4.7.0 before 4.7.0.4 on Windows allows local users to gain privileges via unspecified vectors.