CVE-2026-3602 affects IBM App Connect Enterprise and IBM Integration Bus for z/OS within specified versions. The vulnerability involves external control of file name or path (CWE-73), enabling a remote attacker to trick a user into creating files unknowingly. The CVSS vector indicates the attack requires local access with high attack complexity, no privileges, and user interaction, impacting integrity but not confidentiality or availability. There is no vendor advisory or patch information available at this time.

The vulnerability could allow an attacker to influence file creation on the affected system by socially engineering a user. This may lead to unauthorized modification or insertion of files, impacting the integrity of the system. There is no indication of confidentiality or availability impact. Exploitation requires user interaction and local access, limiting the attack scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious of social engineering attempts that could lead to unintended file creation. No official remediation or temporary fixes have been published by IBM at this time.