VulnSocial

CVE-2026-3602Disclosure(ibm / app_connect_enterprise)

LOWCVSS 5.5 · MEDIUM

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Patch ibm app_connect_enterprise systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.

ibm CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-73CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • app_connect_enterprise
  • integration_bus
  • z\/os

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
ibm
Products
app_connect_enterpriseintegration_busz\/os

1 version affected across 3 products

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-19: 2PoC Mentioned / Linked · 2026-07-19: 1Patch / Workaround · 2026-07-19: 1Technical Details · 2026-07-19: 207-19
Signal classification1 categories
Disclosure
2100.0%
Referenced assets1 URL
Full discourse2 posts
  • Moshe Siman Tov Bustan@MosheTov
    Disclosure

    We found and disclosed CVE-2026-3602 - A cool SQL to command execution on IBM's z/OS products we found, allowing arbitrary file write anywhere on the machine. When writing to the startup dir for example, we can execute scripts the next time windows starts :) There's a video POC in the blog as well https://www.ox.security/blog/cve-2026-3602-sql-injection-in-ibm-app-connect-enterprise-leads-to-code-execution/ IBM App Connect users can patch to the following versions: IBM App Connect Enterprise 13.0.8.0 IBM App Connect Enterprise 12.0.12.27 IBM Integration Bus for z/OS Interim Fix is available to apply to 10.1.0.7 from IBM Fix Central

    Post summary

    The authors disclose CVE-2026-3602, a SQL injection that allows arbitrary file write and command execution on IBM z/OS, provide a video proof of concept, and list patch versions for remediation.

    00052283
    1.2K followersView on X
  • YACTINA@yactina1336
    Disclosure

    CVE-2026-3602: SQL Injection in IBM App Connect Enterprise Leads to Code Execution | OX Security https://www.ox.security/blog/cve-2026-3602-sql-injection-in-ibm-app-connect-enterprise-leads-to-code-execution/

    Post summary

    The article announces CVE-2026-3602, a SQL injection flaw in IBM App Connect Enterprise that can lead to code execution, without mentioning PoC, active exploitation, or patches.

    0000045
    20 followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appibmapp_connect_enterprise---
Appibmintegration_bus---
OSibmz\/os---

Explore more

Back to dashboardibm CVEsapp_connect_enterprise vulnerabilities