CVE-2023-50310 is a Medium severity (CVSS 4.9) flaw in IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3. It transmits or stores authentication credentials by an insecure method that could be intercepted or retrieved. IBM's remediation is APAR PH60425, available through Fix Central.
What's affected
Product: IBM CICS Transaction Gateway for Multiplatforms, versions 9.2 and 9.3. Fixed: IBM's bulletin lists APAR PH60425 and links downloads through Fix Central for AIX, Linux on POWER, Linux on Intel, Linux on IBM Z and Windows. The bulletin's remediation table names 9.2.0.2 and 9.3.0.0 against that APAR, but the table is hard to read as text, so confirm the exact fix levels in IBM's bulletin before you plan. NVD published the record on 23 October 2024.
Severity: the NVD record scores it 4.9 Medium with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, and IBM's bulletin gives the same 4.9, so there is no conflict. High privileges are required, which is why the score stays moderate despite high confidentiality impact.
The same bulletin covers a second issue, CVE-2023-50311, a path disclosure in debugging or error messages with a score of 3.1.
How to check if you're exposed
Identify every CICS Transaction Gateway installation and its version. If you run the gateway on several platforms, list each one, because the fix downloads differ by operating system.
Versions 9.2 and 9.3 are the ones named. Compare your installed build with the fix levels in IBM's bulletin. IBM's text does not describe a command for this, so use the product's own version reporting from your installation documentation.
Also ask where credentials for the gateway are stored and sent. Check that connections to the gateway use encrypted transport, and that configuration files with credentials are readable only by the service account.
Vendor products like this do not appear in a dependency scan, so the inventory is the control. Record each instance with its version, owner and the networks that can reach it.
What to do now
- Read IBM's bulletin and apply APAR PH60425 for your version and operating system, using Fix Central.
- Check that gateway traffic is encrypted in transit and that configuration files holding credentials have tight file permissions.
- Rotate the credentials the gateway uses after patching, since you cannot tell whether an earlier version exposed them.
- Restrict who holds the high privilege accounts needed to exploit the issue.
- Record the patched version in your inventory.
Why it matters
The weakness is CWE-522, insufficiently protected credentials. The description is short: the product transmits or stores authentication credentials using a method that could be intercepted or retrieved. IBM does not describe the method in the bulletin, and I will not guess at it.
The vector tells us two things. The attacker needs high privileges, and the effect is a loss of confidentiality only. So this is less about a stranger breaking in and more about an insider or a compromised administrator getting credentials that unlock other systems. A mainframe gateway often sits between web applications and core transaction systems, and a credential obtained there may be valuable.
KEV is false and no source claims exploitation. Rotating secrets after patching is cheap insurance. For open source components in your own code, the free gold.safeguard.sh/scan scan is a place to start, and the Gold directory lists this CVE with its weakness class.
Quick check
Why is the score only Medium?
The attacker needs high privileges and the impact is limited to confidentiality. That gives 4.9, and both NVD and IBM agree.
Which fix do I need?
IBM lists APAR PH60425, with downloads on Fix Central per platform. Check the bulletin for the exact fix level for 9.2 and 9.3.
Sources
Last reviewed: 19 October 2026.
