CVE-2026-17111
Analyzed Analyzed - Analysis Complete

SQL Injection in IBM i Database

Publication date: 2026-08-12

Last updated on: 2026-08-17

Assigner: IBM Corporation

Description
IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-17
Generated
2026-09-02
AI Q&A
2026-08-13
EPSS Evaluated
2026-08-31
NVD
CVE-2026-17111
EUVD
EUVD-2026-57523

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
ibm i 7.3
ibm i 7.4
ibm i 7.5
ibm i 7.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM i versions 7.6, 7.5, 7.4, and 7.3 are vulnerable to SQL injection. A remote attacker could exploit this by sending specially crafted SQL statements, potentially allowing them to view, add, modify, or delete data in the back-end database.

Detection Guidance

Detection of this SQL injection vulnerability in IBM i systems requires monitoring for unusual SQL queries or database access patterns. Check IBM i job logs for suspicious SQL statements using DSPLOG commands. Review database access logs for unauthorized modifications or deletions. Use IBM i Access Client Solutions to monitor active SQL connections and query executions.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive database information. Attackers might steal, alter, or delete data, leading to data breaches, loss of integrity, or service disruption.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data access or modification. It may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply IBM i PTFs or updates addressing the SQL injection vulnerability. Monitor IBM i security bulletins for patches. Restrict database access to authorized users only. Review and audit SQL query logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17111. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart