IBM Sterling Partner Engagement Manager Information Disclosure

Description

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token

Scores

EPSS (exploitation in 30 days)

0.18% · top 93% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-324 Use of a Key Past its Expiration Date (opens in a new tab)All about CWE-324 and its CVEs

Affected products

• IBM · Sterling Partner Engagement Manager

  • affected 6.2.3.0 – ≤ 6.2.3.5
  • affected 6.2.4.0 – ≤ 6.2.4.2

What to do

Solution: Remediation/Fixes IBM strongly recommends addressing the vulnerability now by upgrading, Product(s) Affected Version Range Remediated Version Instructions / Download IBM Sterling Partner Engagement Manager Essentials Edition 6.2.3.0 – 6.2.3.5 6.2.3.6 Download 6.2.3.6 IBM Sterling Partner Engagement Manager Essentials Edition 6.2.4.0 – 6.2.4.2 6.2.4.3 Download 6.2.4.3 IBM Sterling Partner Engagement Manager Standard Edition 6.2.3.0 – 6.2.3.5 6.2.3.6 Download 6.2.3.6 IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 – 6.2.4.2 6.2.4.3 Download 6.2.4.3

References (1)

• https://www.ibm.com/support/pages/node/7263391 (opens in a new tab)vendor-advisorypatch

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-13723](https://trackcve.app/badge/CVE-2025-13723.svg)](https://trackcve.app/cve/CVE-2025-13723)

Record last updated 13 Mar 2026, 19:34 UTC.