CVE-2016-9991: IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow...

Security readout for executives and security teams

IBM Sterling Order Management versions 9.2 through 9.5 have a cross-site request forgery weakness. A victim with a trusted session could be tricked into sending unauthorized actions to the application. Business risk depends on which actions exposed interfaces allow that user to perform. Exposure is limited to organizations running the listed IBM Sterling Order Management versions. Risk is higher where browser-accessible administrative or operational workflows are reachable by authenticated users who process email, browse external sites, or use shared workstations. Treat this as a targeted product exposure item, not an internet-wide emergency based on current evidence. Prioritize if Sterling Order Management supports critical order, fulfillment, or partner workflows and affected versions remain in use. Mitigation focus: Inventory IBM Sterling Order Management versions across production and non-production environments.; Review IBM X-Force ID 121314 and support advisory swg21998167 for vendor remediation guidance.; Apply IBM-recommended fixes or mitigations where the advisory confirms applicability..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.