CVE-2026-3602 describes a vulnerability in IBM App Connect Enterprise and IBM Integration Bus for z/OS where external control of file name or path can lead to unintended file creation. The vulnerability involves SQL injection vectors and requires a remote attacker to socially engineer a user to trigger the creation of files without their awareness. Affected versions include 13.0.1.0, 12.0.1.0, and 10.1.0.0 through 10.1.0.7. The CVSS 3.1 base score is 4.7, indicating medium severity, with attack vector local, high attack complexity, no privileges required, user interaction required, and impact limited to integrity.

The vulnerability allows a remote attacker to cause a user to unknowingly create files, potentially impacting the integrity of the system. There is no confidentiality or availability impact reported. Exploitation requires user interaction and has high attack complexity, limiting the ease of exploitation. No known exploits are reported in the wild.

No official patch or remediation level has been published by the vendor as of the provided data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of social engineering attempts that could trigger this vulnerability.