IBM Sterling Secure Proxy vulnerabilities

33 CVEs affecting IBM Sterling Secure Proxy, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-78415, published 2026-09-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4462, published 2020-07-16. High severity, CVSS 8.2. EPSS: 3.2% chance of exploitation in the next 30 days. IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection (XXE)…
CVE-2021-29725, published 2021-07-15. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. IBM Secure External Authentication Server 2.4.3.2, 6.0.1, 6.0.2 and IBM Secure Proxy 3.4.3.2, 6.0.1, 6.0.2 could allow a remote user to consume resources causing a denial of service due to a resource…
CVE-2016-6023, published 2016-10-06. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. Directory traversal vulnerability in the Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to read arbitrary…
CVE-2022-22336, published 2022-02-23. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume resources causing a denial of service due to a resource…
CVE-2013-0520, published 2013-05-10. Medium severity, CVSS 4.0. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 allows remote authenticated users to obtain sensitive Java…
CVE-2013-0519, published 2013-05-10. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 provides web-server version data in (1) an unspecified page…
CVE-2021-29728, published 2021-08-30. Medium severity, CVSS 4.9. EPSS: 1% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound…
CVE-2021-29723, published 2021-08-30. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-ForceID:…
CVE-2021-29722, published 2021-08-30. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID:…
CVE-2021-29726, published 2022-05-17. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a certificate is actually associated with the host due to improper validation of…

Latest

CVE-2026-78415, published 2026-09-14. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup.
CVE-2026-75792, published 2026-09-14. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass.
CVE-2024-51453, published 2025-05-28. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.2.0.0 through 6.2.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot"…
CVE-2024-38341, published 2025-05-28. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt…
CVE-2024-41783, published 2025-01-19. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow a privileged user to inject commands into the underlying operating system due to improper validation of…
CVE-2024-38337, published 2025-01-19. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow an unauthorized attacker to retrieve or alter sensitive information contents due to incorrect permission…
CVE-2024-41784, published 2024-11-15. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, and 6.1.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request…
CVE-2023-47699, published 2024-03-15. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2023-47147, published 2024-03-15. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow an attacker to overwrite a log message under specific conditions. IBM X-Force ID: 270598.
CVE-2023-46181, published 2024-03-15. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Sterling Secure Proxy 6.0.3 and 6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 269686.