What is the CVSS score of CVE-2026-3602?

CVE-2026-3602 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-3602?

Yes, a patch is available for CVE-2026-3602. Update the affected software to the latest version immediately.

IBM App Connect Enterprise CVE-2026-3602

EUVD-2026-40385 MEDIUM

External Control of File Name or Path (CWE-73)

2026-06-30 ibm

GHSA-w878-7352-758p

SQLi IBM App Connect Enterprise Integration Bus For Z Os

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

4.7 MEDIUM

Social engineering drives UI:R and AC:H; file creation is local (AV:L); attacker needs no system privileges (PR:N); only integrity is impacted via unauthorized file writes.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Jul 02, 2026 - 18:22 NVD

4.7 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 30, 2026 - 19:55 vuln.today

DescriptionNVD

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.

AnalysisAI

File path control vulnerability (CWE-73) in IBM App Connect Enterprise and IBM Integration Bus for z/OS enables a remote attacker to socially engineer a victim into triggering unauthorized file creation on the local system. Despite being tagged and described as SQL injection, the governing weakness classification is CWE-73 (External Control of File Name or Path), and the described impact - unexpected local file creation - aligns with that CWE rather than database injection. Affected versions span IBM ACE 12.x and 13.x across wide release ranges, as well as IBM Integration Bus for z/OS 10.1.x. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-73 (External Control of File Name or Path) describes a condition where user-controllable input is used, without sufficient validation or sanitization, to determine the name or path of a file used in a filesystem operation. In the context of IBM App Connect Enterprise - an enterprise integration platform that orchestrates message flows, APIs, and data transformations - this likely manifests when externally influenced data reaches a file-creation operation within a flow or message processing pipeline. The affected CPEs are cpe:2.3:a:ibm:app_connect_enterprise and cpe:2.3:a:ibm:integration_bus_for_z/os, covering a broad version spread across ACE 12.0.1.0-12.0.12.26, ACE 13.0.1.0-13.0.7.2, and IIB for z/OS 10.1.0.0-10.1.0.7. Importantly, there is a notable discrepancy between the vulnerability description (which asserts SQL injection) and the assigned CWE (CWE-73, file path control); the CVSS vector and described impact both support a file-path interpretation, not database injection.

RemediationAI

A vendor-released patch is available per the IBM advisory at https://www.ibm.com/support/pages/node/7278350; however, no exact fixed version number is confirmed from the available input data - administrators should consult the advisory directly to identify the specific target release for their ACE 12.x, ACE 13.x, or IIB for z/OS 10.1.x deployment. As a compensating control pending patching, organizations should enforce strict user-awareness training to reduce susceptibility to social engineering, restrict integration flow permissions so that message-processing operations cannot write to sensitive filesystem paths, and audit existing message flows for file-creation operations that accept externally sourced path or filename parameters. Restricting ACE service accounts to write-only designated spool or working directories via OS-level access controls would limit the blast radius of unauthorized file creation without disrupting legitimate integration operations.