CVE-2026-3602: IBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-30 · updated 2026-07-20
Weakness: CWE-73

Description

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.

Affected products

IBM App Connect Enterprise: from 12.0.1.0 before 12.0.12.27; from 13.0.1.0 before 13.0.8.0 — fixed in 12.0.12.27, 13.0.8.0
IBM Integration Bus for z/OS: from 10.1.0.0 through 10.1.0.7

How to fix

Upgrade to a fixed version: IBM App Connect Enterprise 12.0.12.27, 13.0.8.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-3602 or the next vulnerability affects your stack