CVE-2026-3602: IBM App Connect Enterprise SQLi Vulnerability

CVE-2026-3602 Overview

CVE-2026-3602 is a SQL injection vulnerability affecting IBM App Connect Enterprise and IBM Integration Bus for z/OS. The flaw allows a remote attacker to socially engineer a legitimate user into triggering database operations that create files without the user's awareness. The vulnerability maps to two weaknesses: [CWE-89] SQL Injection and [CWE-73] External Control of File Name or Path.

Exploitation requires user interaction, which limits mass exploitation but keeps targeted phishing scenarios viable against integration developers and administrators. IBM has published an advisory with fixed versions and mitigation guidance.

Critical Impact
Successful exploitation enables unauthorized file creation on integration hosts, which can be leveraged to plant configuration artifacts, staging payloads, or persistence files that undermine data integrity.

Affected Products

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.26
IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7

Discovery Timeline

2026-06-30 - CVE-2026-3602 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-3602

Vulnerability Analysis

The vulnerability resides in the SQL handling logic within IBM App Connect Enterprise and IBM Integration Bus for z/OS. An attacker crafts input that, when processed by an authenticated user, injects SQL constructs into a database interaction. The injected statements manipulate downstream file operations, causing files to be created on the host without explicit user intent.

The attack requires local access context and user interaction, which aligns with a scenario where an attacker delivers a malicious flow, template, or input file to an operator. Confidentiality and availability are not directly impacted, but integrity is significantly affected because the attacker controls file creation outcomes.

EPSS data reports a probability of 0.161% at the 5.7 percentile, indicating low observed exploitation likelihood at publication time.

Root Cause

The underlying defect is insufficient sanitization of user-controlled input passed into SQL statements combined with file path resolution logic ([CWE-73], [CWE-89]). The application constructs SQL queries or file references from untrusted values without enforcing parameterization or path validation.

Attack Vector

An attacker uses social engineering to convince a legitimate user to import, execute, or process an attacker-supplied artifact within App Connect Enterprise. The artifact contains crafted SQL fragments that the product parses locally. Execution runs in the context of the invoking user, and side effects include creation of files at attacker-influenced locations.

No verified proof-of-concept code is publicly available. Refer to the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-3602

Indicators of Compromise

Unexpected files appearing in App Connect Enterprise working directories, deployment paths, or user home directories on integration hosts.
Application logs showing SQL statements containing concatenated user input, stacked queries, or unusual INTO OUTFILE, xp_cmdshell, or file-writing functions.
Message flows or deployment artifacts imported from external sources shortly before anomalous file creation events.

Detection Strategies

Enable SQL statement logging on databases connected to App Connect Enterprise and alert on queries containing file-write primitives.
Monitor process telemetry for DataFlowEngine or integration server processes writing files outside expected paths.
Correlate user-initiated flow imports with subsequent file system writes to identify social engineering chains.

Monitoring Recommendations

Baseline expected file creation patterns for integration server accounts and alert on deviations.
Ingest App Connect Enterprise audit logs into a centralized log platform and retain them for retrospective hunts.
Flag inbound artifacts (flows, BAR files, message maps) delivered via email or external channels for review before import.

How to Mitigate CVE-2026-3602

Immediate Actions Required

Apply the fixes referenced in the IBM Support Page to all affected App Connect Enterprise and Integration Bus for z/OS installations.
Inventory environments to confirm the versions in use and prioritize hosts exposed to user-supplied artifacts.
Restrict who can import or deploy message flows and templates to trusted administrators only.

Patch Information

IBM has published fix guidance on the vendor advisory. Upgrade IBM App Connect Enterprise beyond 13.0.7.2 on the 13.x branch and beyond 12.0.12.26 on the 12.x branch. Upgrade IBM Integration Bus for z/OS beyond 10.1.0.7. Consult the IBM Support Page for exact fix pack identifiers.

Workarounds

Train integration developers and operators to reject untrusted flow files, templates, and inputs delivered through social engineering channels.
Run integration server processes under least-privilege accounts to constrain the impact of unauthorized file creation.
Apply file system access controls that prevent integration processes from writing outside designated directories.

bash

# Configuration example
# Verify installed IBM App Connect Enterprise version
mqsiservice -v

# Restrict integration server file write locations via OS-level ACLs (Linux example)
chown -R aceuser:acegrp /opt/ibm/ace-13/server
chmod -R 750 /opt/ibm/ace-13/server