IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00185.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Ibm Subscribe
App Connect Enterprise Subscribe
Integration Bus Subscribe
Integration Bus For Zos Subscribe
Z\/os Subscribe

Configuration 1 [-]

OR cpe:2.3:a:ibm:app_connect_enterprise:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:*:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:a:ibm:integration_bus:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:z\/os:-:*:*:*:*:*:*:*

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Ibm Subscribe
App Connect Enterprise Subscribe
Integration Bus For Zos Subscribe
Advisories

No advisories yet.

Fixes

Solution

IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise and IBM Integration Bus for z/OS Affected Product(s)Version(s)APARRemediation / FixesIBM App Connect Enterprise13.0.1.0 - 13.0.7.2PH71150The APAR (PH71150) is available fromIBM App Connect Enterprise v13- Fix Pack Release 13.0.8.0IBM App Connect Enterprise12.0.1.0 - 12.0.12.26 PH71150The APAR (PH71150) is available fromIBM App Connect Enterprise v12- Fix Pack Release 12.0.12.27IBM Integration Bus for z/OS10.1.0.0 - 10.1.0.7PH71150Interim Fix for APAR (PH71150) is available to apply to 10.1.0.7 from IBM Fix Central

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.ibm.com/support/pages/node/7278350 cve-icon cve-icon
https://www.ox.security/blog/cve-2026-3602-sql-injection-in-ibm-app-connect-enterprise-leads-to-code-execution/ cve-icon
History

Tue, 30 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 30 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
Description IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.
Title IBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection
First Time appeared Ibm
Ibm app Connect Enterprise
Ibm integration Bus For Zos
Weaknesses CWE-73
CPEs cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.26:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:integration_bus_for_zos:10.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:integration_bus_for_zos:10.1.0.7:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm app Connect Enterprise
Ibm integration Bus For Zos
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-07-20T14:26:09.238Z

Reserved: 2026-03-05T14:48:57.881Z

Link: CVE-2026-3602

cve-icon Vulnrichment

Updated: 2026-07-20T14:26:09.238Z

cve-icon NVD

Status : Modified

Published: 2026-06-30T20:17:29.490

Modified: 2026-07-20T15:16:37.650

Link: CVE-2026-3602

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T02:00:05Z

Weaknesses