Vulnerability Description
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ibm | App Connect Enterprise | >= 12.0.1.0, < 12.0.12.27 |
| Ibm | Integration Bus | >= 10.1.0.0, <= 10.1.0.7 |
| Ibm | Z\/Os | - |
Related Weaknesses (CWE)
References
- https://www.ibm.com/support/pages/node/7278350Vendor Advisory
- https://www.ox.security/blog/cve-2026-3602-sql-injection-in-ibm-app-connect-ente
FAQ
What is CVE-2026-3602?
CVE-2026-3602 is a vulnerability with a CVSS score of 4.7 (MEDIUM). IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could...
How severe is CVE-2026-3602?
CVE-2026-3602 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-3602?
Check the references section above for vendor advisories and patch information. Affected products include: Ibm App Connect Enterprise, Ibm Integration Bus, Ibm Z\/Os.