IBM Sterling Partner Engagement Manager vulnerabilities

18 CVEs affecting IBM Sterling Partner Engagement Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-14811, published 2026-03-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-34348, published 2022-09-23. High severity, CVSS 7.1. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose…
CVE-2022-35639, published 2022-07-26. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1, 6.2, and Cloud 22.2 do not limit the length of a connection which could cause the server to become unresponsive. IBM X-Force ID: 230932.
CVE-2023-43045, published 2023-10-23. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896.
CVE-2022-34335, published 2023-01-11. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.1 could allow an authenticated user to exhaust server resources which could lead to a denial of service. IBM X-Force ID: 229705.
CVE-2022-40615, published 2023-01-11. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view,…
CVE-2023-23482, published 2023-06-08. Critical severity, CVSS 9.6. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote…
CVE-2022-34334, published 2022-10-10. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 229704.
CVE-2023-23481, published 2023-06-08. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2023-23480, published 2023-06-08. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the…
CVE-2025-33093, published 2025-05-07. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret.

Latest

CVE-2025-14811, published 2026-03-13. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to…
CVE-2025-13726, published 2026-03-13. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are…
CVE-2025-13723, published 2026-03-13. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token
CVE-2025-13718, published 2026-03-13. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that…
CVE-2025-13702, published 2026-03-13. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary…
CVE-2022-35640, published 2024-07-16. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.2.2 could allow a local attacker to obtain sensitive information when a detailed technical error message is returned. IBM X-Force ID: 230933.
CVE-2023-28517, published 2024-03-13. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering…
CVE-2023-38722, published 2023-10-23. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…