CVE-2025-13718
Published: 13 March 2026
Summary
CVE-2025-13718 is a low-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Ibm Sterling Partner Engagement Manager. Its CVSS base score is 3.7 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 6.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-8 (Transmission Confidentiality and Integrity) and SC-9 (Transmission Confidentiality).
Deeper analysis
IBM Sterling Partner Engagement Manager versions 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 are affected by CVE-2025-13718, a vulnerability that allows sensitive information to be transmitted in cleartext over a communication channel susceptible to sniffing by unauthorized actors. This issue, published on 2026-03-13, is classified under CWE-319 (Cleartext Transmission of Sensitive Information) and carries a CVSS v3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating low severity with low confidentiality impact but no impact on integrity or availability.
A remote attacker with network access can exploit this vulnerability by sniffing the communication channel, though it requires high attack complexity and no user privileges or interaction. Successful exploitation enables the attacker to obtain sensitive information disclosed in cleartext, potentially compromising confidentiality depending on the nature of the data transmitted.
IBM has published an advisory with details on this vulnerability at https://www.ibm.com/support/pages/node/7263391, which security practitioners should consult for mitigation guidance and any available patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208648
Vulnerability details
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables cleartext transmission of sensitive data over networks, directly facilitating passive network sniffing to capture information (T1040).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires cryptographic protection to ensure confidentiality of information transmitted over networks, eliminating the cleartext exposure described in CVE-2025-13718.
Explicitly mandates confidentiality protections for transmitted information, directly mitigating the CWE-319 cleartext transmission vulnerability in the affected IBM product.
Requires use of approved cryptographic modules for protecting sensitive data, addressing the root cause of sniffable cleartext channels in this CVE.