Privilege Escalation Vulnerability in IBM Sterling Connect Direct for Unix

IBM has disclosed a security vulnerability affecting IBM Sterling Connect Direct for Unix, specifically versions 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6. The flaw, tracked as CVE-2026-105453, originates from improper privilege management within the application. This vulnerability allows a local attacker, who has already gained low-level access to the host system, to exploit the software to execute code with elevated privileges. This is a significant risk for environments where the Sterling Connect Direct service is deployed, as it provides a pathway for an attacker to move from a restricted user account to a high-privileged state, potentially leading to full system compromise.

Impact

Successful exploitation of this vulnerability allows local attackers to elevate their privileges on the affected host. This could lead to unauthorized access to sensitive file transfer data, modification of system configurations, or persistence mechanisms installation. Organizations in sectors utilizing Sterling Connect Direct for automated, high-volume file transfers are at risk if local access to these servers is compromised by an unauthorized actor.

Recommendation

1. Patch immediately by upgrading to the latest version of IBM Sterling Connect Direct for Unix that addresses CVE-2026-105453.
2. Review system logs for unauthorized access or suspicious process execution by low-privileged service users.
3. Restrict local user access to servers running the vulnerable Sterling Connect Direct software to minimize the attack surface for local privilege escalation.