CVE-2026-3602
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.26, as well as IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7, are vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.
Risk Assessment
The risk involves potential unauthorized access to the database and possible data manipulation, which could lead to a breach of confidentiality and integrity. An attacker could also exploit this vulnerability for privilege escalation or further attacks on the system.
Recommendation
It is recommended to immediately upgrade to the latest available version of IBM App Connect Enterprise or IBM Integration Bus for z/OS that includes a fix for this vulnerability. Additionally, users should be trained to recognize social engineering attempts.
Other vulnerabilities in IBM App Connect Enterprise
See all- CVE-2026-15435Critical
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27 are vulnerable to remote directory traversal. An attacker can send a specially crafted URL containing '/../' sequences to write arbitrary files on the system.
- CVE-2026-14522High
IBM App Connect Enterprise has a vulnerability allowing a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.
- CVE-2026-14519High
IBM App Connect Enterprise is vulnerable to a path traversal attack, allowing a remote attacker to read arbitrary files on the server.
- CVE-2026-12947High
IBM App Connect Enterprise stores potentially sensitive information in log files that could be read by a local user.
Original NVD description (English source)
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.