Advisory · CVE-2026-105453
IBM Sterling Connect:Direct for Unix improper privilege management can give a local attacker elevated privileges
IBM Sterling Connect:Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management. CVSS 3.1 8.4.
- Vendor
- IBM
- Product
- IBM Sterling Connect:Direct for Unix
- Identifier / CWE
- CVE-2026-105453
CWE-269 - Action timing
- Immediate
Explain it like I’m five
A user who already has a local foothold on the Connect:Direct host can use a privilege check that is not enforced properly to gain elevated privileges on that host.
- 01Local access held
An attacker holds local access and low privileges on a Connect:Direct for Unix host.
- 02Privilege flaw used
The attacker uses the improper privilege management flaw (CWE-269) in the affected release.
- 03Privileges elevated
Per IBM, the attacker can gain elevated privileges on the host.
What happened
IBM PSIRT disclosed CVE-2026-105453: IBM Sterling Connect:Direct for Unix could allow a local attacker to gain elevated privileges due to improper privilege management (CWE-269). The CVSS 3.1 score is 8.4, with local access and low privileges required, no user interaction, and a changed scope.
Per the vendor affected data in the NVD record, affected releases are 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6. No fixed version is stated in the NVD record itself; IBM’s bulletin is the reference for the fix for each line.
What to do
- Inventory IBM Sterling Connect:Direct for Unix hosts and note whether each runs the 6.3 or 6.4 line.
- Apply the fix for your release line from IBM security bulletin 7292735; the NVD record lists the affected ranges, so confirm your line against the bulletin rather than assuming a fixed version.
- Restrict access to trusted networks and named users while remediation is underway.
- Hunt for unexpected privilege gains, new privileged accounts, and Connect:Direct processes or files modified by non-privileged users.
- Verify the deployed fix level after updating, not just that an update ran.
Management note
Connect:Direct moves files between systems that trust each other, often with service accounts that reach far. A local privilege gain on that host can become a trusted-channel problem, so patch and review who holds any local account on these hosts.