CVE-2026-3602
EUVD-2026-4038530.06.2026, 20:17
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| ibm | app_connect_enterprise | 12.0.1.0 ≤ 𝑥 < 12.0.12.27 |
| ibm | app_connect_enterprise | 13.0.1.0 ≤ 𝑥 < 13.0.8.0 |
| ibm | integration_bus | 10.1.0.0 ≤ 𝑥 ≤ 10.1.0.7 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| ibm | connect\ | 13.0.1.0 ≤ 𝑥 ≤ 13.0.7.2 | CNA |
| ibm | connect\ | 12.0.1.0 ≤ 𝑥 ≤ 12.0.12.26 | CNA |
| ibm | connect\ | 10.1.0.0 ≤ 𝑥 ≤ 10.1.0.7 | CNA |
Common Weakness Enumeration
- CWE-73 - External Control of File Name or PathThe software allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.